--- Authorino logs from kuadrant-system (label=authorino-resource=authorino) ---
{"level":"debug","ts":"2026-07-06T18:57:19Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"82abe935-5c7c-4193-86cd-d85277ce853a","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-07-06T18:57:19Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"82abe935-5c7c-4193-86cd-d85277ce853a","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-06T18:57:19Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"82abe935-5c7c-4193-86cd-d85277ce853a","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"4c117213-6436-4d5e-b6f2-0dc80354b8ad","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=b4ed87fd-f39c-46f5-8b5f-dad8294f1243"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/6aa6542dfc28"]}}
{"level":"debug","ts":"2026-07-06T18:57:19Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"82abe935-5c7c-4193-86cd-d85277ce853a","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/6aa6542dfc28"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=b4ed87fd-f39c-46f5-8b5f-dad8294f1243"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"4c117213-6436-4d5e-b6f2-0dc80354b8ad","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"825b4e4809451f9debccbe1150b699f739c117934b0bf98871cc2a21cd18800d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.66:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-47f1eb.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/api-keys/9df3b2e0-4f95-475f-9588-312ff12657b9",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T18:57:19Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"82abe935-5c7c-4193-86cd-d85277ce853a","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T18:57:19Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"82abe935-5c7c-4193-86cd-d85277ce853a","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T18:57:19Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"82abe935-5c7c-4193-86cd-d85277ce853a","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-47f1eb/auth-test-model-47f1eb\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T18:57:19Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"82abe935-5c7c-4193-86cd-d85277ce853a","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-06T18:57:19Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"82abe935-5c7c-4193-86cd-d85277ce853a","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-06T18:57:19Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"82abe935-5c7c-4193-86cd-d85277ce853a","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-06T18:57:19Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"82abe935-5c7c-4193-86cd-d85277ce853a","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T18:57:19Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"82abe935-5c7c-4193-86cd-d85277ce853a","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T18:57:34Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"54b7cd4d-9ad6-4fb4-aa42-f0acd7979019","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:59524","PortSpecifier":{"PortValue":59524}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.66:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"54b7cd4d-9ad6-4fb4-aa42-f0acd7979019","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-47f1eb.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T18:57:34Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"54b7cd4d-9ad6-4fb4-aa42-f0acd7979019","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:59524","PortSpecifier":{"PortValue":59524}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.66:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783364254,"nanos":556339657},"http":{"id":"54b7cd4d-9ad6-4fb4-aa42-f0acd7979019","method":"POST","headers":{":authority":"e2e-shared-a-47f1eb.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T18:57:34Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"54b7cd4d-9ad6-4fb4-aa42-f0acd7979019","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-07-06T18:57:34Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"54b7cd4d-9ad6-4fb4-aa42-f0acd7979019","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-06T18:57:34Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"54b7cd4d-9ad6-4fb4-aa42-f0acd7979019","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"4c117213-6436-4d5e-b6f2-0dc80354b8ad","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=b4ed87fd-f39c-46f5-8b5f-dad8294f1243"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/6aa6542dfc28"]}}
{"level":"debug","ts":"2026-07-06T18:57:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"54b7cd4d-9ad6-4fb4-aa42-f0acd7979019","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/6aa6542dfc28"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=b4ed87fd-f39c-46f5-8b5f-dad8294f1243"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"4c117213-6436-4d5e-b6f2-0dc80354b8ad","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"825b4e4809451f9debccbe1150b699f739c117934b0bf98871cc2a21cd18800d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.66:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-47f1eb.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T18:57:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"54b7cd4d-9ad6-4fb4-aa42-f0acd7979019","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T18:57:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"54b7cd4d-9ad6-4fb4-aa42-f0acd7979019","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T18:57:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"54b7cd4d-9ad6-4fb4-aa42-f0acd7979019","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-47f1eb/auth-test-model-47f1eb\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T18:57:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"54b7cd4d-9ad6-4fb4-aa42-f0acd7979019","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-06T18:57:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"54b7cd4d-9ad6-4fb4-aa42-f0acd7979019","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-06T18:57:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"54b7cd4d-9ad6-4fb4-aa42-f0acd7979019","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-06T18:57:34Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"54b7cd4d-9ad6-4fb4-aa42-f0acd7979019","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T18:57:34Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"54b7cd4d-9ad6-4fb4-aa42-f0acd7979019","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T18:57:34Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6782c894-b309-4946-b4ef-6953c9ee4754","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:54580","PortSpecifier":{"PortValue":54580}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.67:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"6782c894-b309-4946-b4ef-6953c9ee4754","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-b19850.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T18:57:34Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6782c894-b309-4946-b4ef-6953c9ee4754","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:54580","PortSpecifier":{"PortValue":54580}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.67:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783364254,"nanos":598587298},"http":{"id":"6782c894-b309-4946-b4ef-6953c9ee4754","method":"POST","headers":{":authority":"e2e-shared-b-b19850.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T18:57:34Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"6782c894-b309-4946-b4ef-6953c9ee4754","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-07-06T18:57:34Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"6782c894-b309-4946-b4ef-6953c9ee4754","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-06T18:57:34Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"6782c894-b309-4946-b4ef-6953c9ee4754","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"4c117213-6436-4d5e-b6f2-0dc80354b8ad","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=b4ed87fd-f39c-46f5-8b5f-dad8294f1243"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/6aa6542dfc28"]}}
{"level":"debug","ts":"2026-07-06T18:57:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"6782c894-b309-4946-b4ef-6953c9ee4754","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/6aa6542dfc28"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=b4ed87fd-f39c-46f5-8b5f-dad8294f1243"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"4c117213-6436-4d5e-b6f2-0dc80354b8ad","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"cbee4de24e7f52377467bc1c31e35371aa80bf91cd74077a1bc0ff135956cb05"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.67:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-b19850.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T18:57:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6782c894-b309-4946-b4ef-6953c9ee4754","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T18:57:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6782c894-b309-4946-b4ef-6953c9ee4754","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T18:57:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6782c894-b309-4946-b4ef-6953c9ee4754","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-b19850/auth-test-model-b19850\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T18:57:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"6782c894-b309-4946-b4ef-6953c9ee4754","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-06T18:57:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6782c894-b309-4946-b4ef-6953c9ee4754","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-06T18:57:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6782c894-b309-4946-b4ef-6953c9ee4754","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-06T18:57:34Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6782c894-b309-4946-b4ef-6953c9ee4754","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T18:57:34Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6782c894-b309-4946-b4ef-6953c9ee4754","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T18:57:34Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ce9cad49-4fb4-422a-a9ba-bb1069180ec7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:59538","PortSpecifier":{"PortValue":59538}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.66:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"ce9cad49-4fb4-422a-a9ba-bb1069180ec7","method":"POST","path":"/maas-api/internal/v1/subscriptions/select","host":"e2e-shared-a-47f1eb.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T18:57:34Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ce9cad49-4fb4-422a-a9ba-bb1069180ec7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:59538","PortSpecifier":{"PortValue":59538}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.66:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783364254,"nanos":640714868},"http":{"id":"ce9cad49-4fb4-422a-a9ba-bb1069180ec7","method":"POST","headers":{":authority":"e2e-shared-a-47f1eb.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/internal/v1/subscriptions/select",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T18:57:34Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"ce9cad49-4fb4-422a-a9ba-bb1069180ec7","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1LtXMsOJmhEr5cEjj_w3BAQzSRWFNQEJvGSABSIGZalWFF4AYvEUi7nF3CrqD"}
{"level":"debug","ts":"2026-07-06T18:57:34Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"ce9cad49-4fb4-422a-a9ba-bb1069180ec7","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-47f1eb.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1LtXMsOJmhEr5cEjj_w3BAQzSRWFNQEJvGSABSIGZalWFF4AYvEUi7nF3CrqD\"}"}
{"level":"debug","ts":"2026-07-06T18:57:34Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"ce9cad49-4fb4-422a-a9ba-bb1069180ec7","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-47f1eb.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"8250de2c-56be-4b35-a366-5428aca5f51f","keyName":"e2e-auth-iso-a-c0dee1","subscription":"e2e-auth-iso-302d6d","tenant":"e2e-shared-a-47f1eb","userId":"8250de2c-56be-4b35-a366-5428aca5f51f","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-06T18:57:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"ce9cad49-4fb4-422a-a9ba-bb1069180ec7","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T18:57:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ce9cad49-4fb4-422a-a9ba-bb1069180ec7","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T18:57:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ce9cad49-4fb4-422a-a9ba-bb1069180ec7","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T18:57:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ce9cad49-4fb4-422a-a9ba-bb1069180ec7","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-47f1eb/auth-test-model-47f1eb\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T18:57:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ce9cad49-4fb4-422a-a9ba-bb1069180ec7","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-auth-iso-302d6d"}
{"level":"debug","ts":"2026-07-06T18:57:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ce9cad49-4fb4-422a-a9ba-bb1069180ec7","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-06T18:57:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"ce9cad49-4fb4-422a-a9ba-bb1069180ec7","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-06T18:57:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ce9cad49-4fb4-422a-a9ba-bb1069180ec7","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-06T18:57:34Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ce9cad49-4fb4-422a-a9ba-bb1069180ec7","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T18:57:34Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ce9cad49-4fb4-422a-a9ba-bb1069180ec7","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T18:57:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/100d7e4a2b711b8ded2525a330c9e9cf23a4e00affe62e522c552538d5c1404c"}
{"level":"info","ts":"2026-07-06T18:57:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/3a90d280b2bd8cd0a6bde9869ad60654253b894585e4f2ff22c3a98296dd40cb"}
{"level":"info","ts":"2026-07-06T18:57:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/680faeadf830d181853b279630e3a54bbc70bf9a24215933ad1b8c6800066cf0"}
{"level":"info","ts":"2026-07-06T18:57:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/a6639189f458c7979713100691daecc47e50625f0c92b0213512eff76f029925"}
{"level":"info","ts":"2026-07-06T18:57:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/20b85f78812b950d5775edf2fc459bedd0462a07d647ec1ead71a8de2199c054"}
{"level":"info","ts":"2026-07-06T18:57:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/9b3c23674960ca8a4eb84ef3847f92719a3ae06d3a0cadaed69e61ab21390145"}
{"level":"info","ts":"2026-07-06T18:57:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/d2efc0837d9343c23aa820e666d671897f03825ef715e01103950c856c73a5f9"}
{"level":"info","ts":"2026-07-06T18:57:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/23b1dcb1da6aa61c665b10512f8f4468f2f79b8ab490b1fbd9959504ab3e04ce"}
{"level":"info","ts":"2026-07-06T18:57:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/83d5a619a890961f82ff5c6ecc5fce7162c1dfc8f5c2d6804500a8c6988c7356"}
{"level":"info","ts":"2026-07-06T18:57:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/18f31d500327fd688f554bbf5bbf47df44e2a8ca711b039badc584a442ffa939"}
{"level":"info","ts":"2026-07-06T18:57:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/0fd47c53b918da0b7cb7112f913259f406a50a51e521578330ff43f813d6bc80"}
{"level":"info","ts":"2026-07-06T18:57:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/5258d4c8517ae6ae009293b4d3e07d9464510517efdc1064598c50b828d65164"}
{"level":"info","ts":"2026-07-06T18:57:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/dc2f70498152384cbd38c2893d03ac0a76d16354756be512645c259aaab5ec6c"}
{"level":"info","ts":"2026-07-06T18:57:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/db5c71b8603d98ddf3506ef0887604fa441f52f976ad41f9938a1b164b6e195f"}
{"level":"info","ts":"2026-07-06T18:57:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/6f4b7181c08be21f8fcfcaf9ede64abe45752013038f70a99c2206f6a3b73d0d"}
{"level":"info","ts":"2026-07-06T18:57:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/66315ce69aea81ffddc9c51ea3a0471f36afebb10641136eb166ca3a1bc17b11"}
{"level":"debug","ts":"2026-07-06T18:57:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"fc16a43a821191670fdc63ffb7bf3ff53176ccc44a4858cb008259a58b0f4d92","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T18:57:51Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T18:57:51Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-06T18:57:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/fc16a43a821191670fdc63ffb7bf3ff53176ccc44a4858cb008259a58b0f4d92","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T18:57:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"fc16a43a821191670fdc63ffb7bf3ff53176ccc44a4858cb008259a58b0f4d92","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:57:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"fc16a43a821191670fdc63ffb7bf3ff53176ccc44a4858cb008259a58b0f4d92","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:57:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"fc16a43a821191670fdc63ffb7bf3ff53176ccc44a4858cb008259a58b0f4d92","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T18:57:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/fc16a43a821191670fdc63ffb7bf3ff53176ccc44a4858cb008259a58b0f4d92"}
{"level":"debug","ts":"2026-07-06T18:57:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/fc16a43a821191670fdc63ffb7bf3ff53176ccc44a4858cb008259a58b0f4d92","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-06T18:57:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"fc16a43a821191670fdc63ffb7bf3ff53176ccc44a4858cb008259a58b0f4d92","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T18:57:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/fc16a43a821191670fdc63ffb7bf3ff53176ccc44a4858cb008259a58b0f4d92"}
{"level":"debug","ts":"2026-07-06T18:57:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"fc16a43a821191670fdc63ffb7bf3ff53176ccc44a4858cb008259a58b0f4d92","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T18:57:51Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T18:57:51Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["fc16a43a821191670fdc63ffb7bf3ff53176ccc44a4858cb008259a58b0f4d92"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T18:57:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"fc16a43a821191670fdc63ffb7bf3ff53176ccc44a4858cb008259a58b0f4d92","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:57:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"fc16a43a821191670fdc63ffb7bf3ff53176ccc44a4858cb008259a58b0f4d92","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:57:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/fc16a43a821191670fdc63ffb7bf3ff53176ccc44a4858cb008259a58b0f4d92","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T18:57:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/fc16a43a821191670fdc63ffb7bf3ff53176ccc44a4858cb008259a58b0f4d92"}
{"level":"debug","ts":"2026-07-06T18:57:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"dea3566aff50bf52fe2d7c8f29a39148d8b5d8c43bf7893cad800ca86a951771","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T18:57:51Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T18:57:51Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-06T18:57:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/dea3566aff50bf52fe2d7c8f29a39148d8b5d8c43bf7893cad800ca86a951771","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T18:57:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"dea3566aff50bf52fe2d7c8f29a39148d8b5d8c43bf7893cad800ca86a951771","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:57:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"dea3566aff50bf52fe2d7c8f29a39148d8b5d8c43bf7893cad800ca86a951771","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:57:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"dea3566aff50bf52fe2d7c8f29a39148d8b5d8c43bf7893cad800ca86a951771","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T18:57:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/dea3566aff50bf52fe2d7c8f29a39148d8b5d8c43bf7893cad800ca86a951771"}
{"level":"debug","ts":"2026-07-06T18:57:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/dea3566aff50bf52fe2d7c8f29a39148d8b5d8c43bf7893cad800ca86a951771","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-06T18:57:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"dea3566aff50bf52fe2d7c8f29a39148d8b5d8c43bf7893cad800ca86a951771","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T18:57:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/dea3566aff50bf52fe2d7c8f29a39148d8b5d8c43bf7893cad800ca86a951771"}
{"level":"debug","ts":"2026-07-06T18:57:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"dea3566aff50bf52fe2d7c8f29a39148d8b5d8c43bf7893cad800ca86a951771","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T18:57:51Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T18:57:51Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["dea3566aff50bf52fe2d7c8f29a39148d8b5d8c43bf7893cad800ca86a951771"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T18:57:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"dea3566aff50bf52fe2d7c8f29a39148d8b5d8c43bf7893cad800ca86a951771","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:57:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5a9d65c5701fb29718b4291333482e202ccca1ec287d466e5bbc52ac71e6f97d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T18:57:51Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T18:57:51Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-06T18:57:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/5a9d65c5701fb29718b4291333482e202ccca1ec287d466e5bbc52ac71e6f97d","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T18:57:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5a9d65c5701fb29718b4291333482e202ccca1ec287d466e5bbc52ac71e6f97d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:57:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"dea3566aff50bf52fe2d7c8f29a39148d8b5d8c43bf7893cad800ca86a951771","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:57:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5a9d65c5701fb29718b4291333482e202ccca1ec287d466e5bbc52ac71e6f97d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:57:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5a9d65c5701fb29718b4291333482e202ccca1ec287d466e5bbc52ac71e6f97d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T18:57:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5a9d65c5701fb29718b4291333482e202ccca1ec287d466e5bbc52ac71e6f97d"}
{"level":"debug","ts":"2026-07-06T18:57:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/dea3566aff50bf52fe2d7c8f29a39148d8b5d8c43bf7893cad800ca86a951771","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-06T18:57:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5a9d65c5701fb29718b4291333482e202ccca1ec287d466e5bbc52ac71e6f97d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T18:57:51Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T18:57:51Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["5a9d65c5701fb29718b4291333482e202ccca1ec287d466e5bbc52ac71e6f97d"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T18:57:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/dea3566aff50bf52fe2d7c8f29a39148d8b5d8c43bf7893cad800ca86a951771"}
{"level":"debug","ts":"2026-07-06T18:57:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/5a9d65c5701fb29718b4291333482e202ccca1ec287d466e5bbc52ac71e6f97d","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T18:57:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5a9d65c5701fb29718b4291333482e202ccca1ec287d466e5bbc52ac71e6f97d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:57:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5a9d65c5701fb29718b4291333482e202ccca1ec287d466e5bbc52ac71e6f97d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T18:57:51Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T18:57:51Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T18:57:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5a9d65c5701fb29718b4291333482e202ccca1ec287d466e5bbc52ac71e6f97d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:57:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5a9d65c5701fb29718b4291333482e202ccca1ec287d466e5bbc52ac71e6f97d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T18:57:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5a9d65c5701fb29718b4291333482e202ccca1ec287d466e5bbc52ac71e6f97d"}
{"level":"debug","ts":"2026-07-06T18:57:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5a9d65c5701fb29718b4291333482e202ccca1ec287d466e5bbc52ac71e6f97d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:57:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/5a9d65c5701fb29718b4291333482e202ccca1ec287d466e5bbc52ac71e6f97d","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-06T18:57:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"03ac742de3b54ad0743b12586f4f86301de57c3a271b812c31477b3a870867d3","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T18:57:51Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T18:57:51Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T18:57:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5a9d65c5701fb29718b4291333482e202ccca1ec287d466e5bbc52ac71e6f97d"}
{"level":"debug","ts":"2026-07-06T18:57:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/03ac742de3b54ad0743b12586f4f86301de57c3a271b812c31477b3a870867d3","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T18:57:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"03ac742de3b54ad0743b12586f4f86301de57c3a271b812c31477b3a870867d3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:57:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5a9d65c5701fb29718b4291333482e202ccca1ec287d466e5bbc52ac71e6f97d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T18:57:51Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T18:57:51Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["5a9d65c5701fb29718b4291333482e202ccca1ec287d466e5bbc52ac71e6f97d"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T18:57:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5a9d65c5701fb29718b4291333482e202ccca1ec287d466e5bbc52ac71e6f97d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:57:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"03ac742de3b54ad0743b12586f4f86301de57c3a271b812c31477b3a870867d3","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T18:57:51Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T18:57:51Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T18:57:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/03ac742de3b54ad0743b12586f4f86301de57c3a271b812c31477b3a870867d3"}
{"level":"debug","ts":"2026-07-06T18:57:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/5a9d65c5701fb29718b4291333482e202ccca1ec287d466e5bbc52ac71e6f97d","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T18:57:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"03ac742de3b54ad0743b12586f4f86301de57c3a271b812c31477b3a870867d3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:57:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5a9d65c5701fb29718b4291333482e202ccca1ec287d466e5bbc52ac71e6f97d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T18:57:51Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T18:57:51Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T18:57:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5a9d65c5701fb29718b4291333482e202ccca1ec287d466e5bbc52ac71e6f97d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:57:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"03ac742de3b54ad0743b12586f4f86301de57c3a271b812c31477b3a870867d3","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T18:57:51Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T18:57:51Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["03ac742de3b54ad0743b12586f4f86301de57c3a271b812c31477b3a870867d3"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T18:57:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5a9d65c5701fb29718b4291333482e202ccca1ec287d466e5bbc52ac71e6f97d"}
{"level":"debug","ts":"2026-07-06T18:57:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/03ac742de3b54ad0743b12586f4f86301de57c3a271b812c31477b3a870867d3","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T18:57:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"03ac742de3b54ad0743b12586f4f86301de57c3a271b812c31477b3a870867d3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:57:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5a9d65c5701fb29718b4291333482e202ccca1ec287d466e5bbc52ac71e6f97d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T18:57:51Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T18:57:51Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["5a9d65c5701fb29718b4291333482e202ccca1ec287d466e5bbc52ac71e6f97d"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T18:57:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5a9d65c5701fb29718b4291333482e202ccca1ec287d466e5bbc52ac71e6f97d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:57:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"03ac742de3b54ad0743b12586f4f86301de57c3a271b812c31477b3a870867d3","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T18:57:51Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T18:57:51Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T18:57:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/03ac742de3b54ad0743b12586f4f86301de57c3a271b812c31477b3a870867d3"}
{"level":"info","ts":"2026-07-06T18:57:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"03ac742de3b54ad0743b12586f4f86301de57c3a271b812c31477b3a870867d3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:57:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5a9d65c5701fb29718b4291333482e202ccca1ec287d466e5bbc52ac71e6f97d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T18:57:51Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T18:57:51Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-06T18:57:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/5a9d65c5701fb29718b4291333482e202ccca1ec287d466e5bbc52ac71e6f97d","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T18:57:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5a9d65c5701fb29718b4291333482e202ccca1ec287d466e5bbc52ac71e6f97d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:57:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"fbdc0f099c5f0482cf8bd22695623cde02d28b9fbf8f0e782579fad6bdd9083a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T18:57:51Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T18:57:51Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T18:57:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5a9d65c5701fb29718b4291333482e202ccca1ec287d466e5bbc52ac71e6f97d"}
{"level":"info","ts":"2026-07-06T18:57:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"fbdc0f099c5f0482cf8bd22695623cde02d28b9fbf8f0e782579fad6bdd9083a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:57:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"03ac742de3b54ad0743b12586f4f86301de57c3a271b812c31477b3a870867d3","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T18:57:51Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T18:57:51Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["03ac742de3b54ad0743b12586f4f86301de57c3a271b812c31477b3a870867d3"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-06T18:57:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/fbdc0f099c5f0482cf8bd22695623cde02d28b9fbf8f0e782579fad6bdd9083a","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T18:57:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"03ac742de3b54ad0743b12586f4f86301de57c3a271b812c31477b3a870867d3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:57:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f7a881610c8fda197c39df80005b3793951a6331228f22cdc9803b8d8896142a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T18:57:51Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T18:57:51Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T18:57:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/fbdc0f099c5f0482cf8bd22695623cde02d28b9fbf8f0e782579fad6bdd9083a"}
{"level":"debug","ts":"2026-07-06T18:57:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/03ac742de3b54ad0743b12586f4f86301de57c3a271b812c31477b3a870867d3","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T18:57:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f7a881610c8fda197c39df80005b3793951a6331228f22cdc9803b8d8896142a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:57:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5a9d65c5701fb29718b4291333482e202ccca1ec287d466e5bbc52ac71e6f97d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T18:57:51Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T18:57:51Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["5a9d65c5701fb29718b4291333482e202ccca1ec287d466e5bbc52ac71e6f97d"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T18:57:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5a9d65c5701fb29718b4291333482e202ccca1ec287d466e5bbc52ac71e6f97d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:57:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"fbdc0f099c5f0482cf8bd22695623cde02d28b9fbf8f0e782579fad6bdd9083a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T18:57:51Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T18:57:51Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["fbdc0f099c5f0482cf8bd22695623cde02d28b9fbf8f0e782579fad6bdd9083a"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T18:57:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/03ac742de3b54ad0743b12586f4f86301de57c3a271b812c31477b3a870867d3"}
{"level":"debug","ts":"2026-07-06T18:57:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/f7a881610c8fda197c39df80005b3793951a6331228f22cdc9803b8d8896142a","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T18:57:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"fbdc0f099c5f0482cf8bd22695623cde02d28b9fbf8f0e782579fad6bdd9083a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:57:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"03ac742de3b54ad0743b12586f4f86301de57c3a271b812c31477b3a870867d3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:57:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f7a881610c8fda197c39df80005b3793951a6331228f22cdc9803b8d8896142a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T18:57:51Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T18:57:51Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T18:57:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f7a881610c8fda197c39df80005b3793951a6331228f22cdc9803b8d8896142a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:57:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5a9d65c5701fb29718b4291333482e202ccca1ec287d466e5bbc52ac71e6f97d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:57:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"fbdc0f099c5f0482cf8bd22695623cde02d28b9fbf8f0e782579fad6bdd9083a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:57:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f7a881610c8fda197c39df80005b3793951a6331228f22cdc9803b8d8896142a","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T18:57:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f7a881610c8fda197c39df80005b3793951a6331228f22cdc9803b8d8896142a"}
{"level":"debug","ts":"2026-07-06T18:57:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/5a9d65c5701fb29718b4291333482e202ccca1ec287d466e5bbc52ac71e6f97d","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-06T18:57:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f7a881610c8fda197c39df80005b3793951a6331228f22cdc9803b8d8896142a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T18:57:52Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T18:57:52Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["f7a881610c8fda197c39df80005b3793951a6331228f22cdc9803b8d8896142a"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T18:57:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5a9d65c5701fb29718b4291333482e202ccca1ec287d466e5bbc52ac71e6f97d"}
{"level":"info","ts":"2026-07-06T18:57:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f7a881610c8fda197c39df80005b3793951a6331228f22cdc9803b8d8896142a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:57:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f7a881610c8fda197c39df80005b3793951a6331228f22cdc9803b8d8896142a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:57:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/fbdc0f099c5f0482cf8bd22695623cde02d28b9fbf8f0e782579fad6bdd9083a","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T18:57:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/fbdc0f099c5f0482cf8bd22695623cde02d28b9fbf8f0e782579fad6bdd9083a"}
{"level":"debug","ts":"2026-07-06T18:57:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/f7a881610c8fda197c39df80005b3793951a6331228f22cdc9803b8d8896142a","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-06T18:57:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"847f9857c9194bde9fa59bb12ca1c19030751765bcc282dddd8c9a1c0f3167da","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T18:57:52Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T18:57:52Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T18:57:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f7a881610c8fda197c39df80005b3793951a6331228f22cdc9803b8d8896142a"}
{"level":"debug","ts":"2026-07-06T18:57:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/847f9857c9194bde9fa59bb12ca1c19030751765bcc282dddd8c9a1c0f3167da","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T18:57:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"847f9857c9194bde9fa59bb12ca1c19030751765bcc282dddd8c9a1c0f3167da","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:57:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"138ad913ab0cbd3091e81807e01bb3be6e433b18766bcb3c0f9fcb677e35f76b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T18:57:52Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T18:57:52Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T18:57:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/847f9857c9194bde9fa59bb12ca1c19030751765bcc282dddd8c9a1c0f3167da"}
{"level":"debug","ts":"2026-07-06T18:57:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/138ad913ab0cbd3091e81807e01bb3be6e433b18766bcb3c0f9fcb677e35f76b","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T18:57:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"138ad913ab0cbd3091e81807e01bb3be6e433b18766bcb3c0f9fcb677e35f76b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:57:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"847f9857c9194bde9fa59bb12ca1c19030751765bcc282dddd8c9a1c0f3167da","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T18:57:52Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T18:57:52Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["847f9857c9194bde9fa59bb12ca1c19030751765bcc282dddd8c9a1c0f3167da"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T18:57:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"847f9857c9194bde9fa59bb12ca1c19030751765bcc282dddd8c9a1c0f3167da","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:57:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"138ad913ab0cbd3091e81807e01bb3be6e433b18766bcb3c0f9fcb677e35f76b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T18:57:52Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T18:57:52Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T18:57:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/138ad913ab0cbd3091e81807e01bb3be6e433b18766bcb3c0f9fcb677e35f76b"}
{"level":"debug","ts":"2026-07-06T18:57:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/847f9857c9194bde9fa59bb12ca1c19030751765bcc282dddd8c9a1c0f3167da","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T18:57:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"138ad913ab0cbd3091e81807e01bb3be6e433b18766bcb3c0f9fcb677e35f76b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:57:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"847f9857c9194bde9fa59bb12ca1c19030751765bcc282dddd8c9a1c0f3167da","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T18:57:52Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T18:57:52Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T18:57:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"847f9857c9194bde9fa59bb12ca1c19030751765bcc282dddd8c9a1c0f3167da","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:57:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"138ad913ab0cbd3091e81807e01bb3be6e433b18766bcb3c0f9fcb677e35f76b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T18:57:52Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T18:57:52Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["138ad913ab0cbd3091e81807e01bb3be6e433b18766bcb3c0f9fcb677e35f76b"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T18:57:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/847f9857c9194bde9fa59bb12ca1c19030751765bcc282dddd8c9a1c0f3167da"}
{"level":"info","ts":"2026-07-06T18:57:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"138ad913ab0cbd3091e81807e01bb3be6e433b18766bcb3c0f9fcb677e35f76b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:57:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"847f9857c9194bde9fa59bb12ca1c19030751765bcc282dddd8c9a1c0f3167da","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T18:57:52Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T18:57:52Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["847f9857c9194bde9fa59bb12ca1c19030751765bcc282dddd8c9a1c0f3167da"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-06T18:57:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/138ad913ab0cbd3091e81807e01bb3be6e433b18766bcb3c0f9fcb677e35f76b","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T18:57:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"847f9857c9194bde9fa59bb12ca1c19030751765bcc282dddd8c9a1c0f3167da","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:57:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"138ad913ab0cbd3091e81807e01bb3be6e433b18766bcb3c0f9fcb677e35f76b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T18:57:52Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T18:57:52Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T18:57:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"138ad913ab0cbd3091e81807e01bb3be6e433b18766bcb3c0f9fcb677e35f76b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:57:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"847f9857c9194bde9fa59bb12ca1c19030751765bcc282dddd8c9a1c0f3167da","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:57:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"138ad913ab0cbd3091e81807e01bb3be6e433b18766bcb3c0f9fcb677e35f76b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:57:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"138ad913ab0cbd3091e81807e01bb3be6e433b18766bcb3c0f9fcb677e35f76b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T18:57:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/138ad913ab0cbd3091e81807e01bb3be6e433b18766bcb3c0f9fcb677e35f76b"}
{"level":"debug","ts":"2026-07-06T18:57:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/847f9857c9194bde9fa59bb12ca1c19030751765bcc282dddd8c9a1c0f3167da","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-06T18:57:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"138ad913ab0cbd3091e81807e01bb3be6e433b18766bcb3c0f9fcb677e35f76b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T18:57:52Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T18:57:52Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["138ad913ab0cbd3091e81807e01bb3be6e433b18766bcb3c0f9fcb677e35f76b"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T18:57:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/847f9857c9194bde9fa59bb12ca1c19030751765bcc282dddd8c9a1c0f3167da"}
{"level":"debug","ts":"2026-07-06T18:57:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/138ad913ab0cbd3091e81807e01bb3be6e433b18766bcb3c0f9fcb677e35f76b","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T18:57:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"138ad913ab0cbd3091e81807e01bb3be6e433b18766bcb3c0f9fcb677e35f76b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:57:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"138ad913ab0cbd3091e81807e01bb3be6e433b18766bcb3c0f9fcb677e35f76b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T18:57:52Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T18:57:52Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T18:57:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"138ad913ab0cbd3091e81807e01bb3be6e433b18766bcb3c0f9fcb677e35f76b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:57:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"138ad913ab0cbd3091e81807e01bb3be6e433b18766bcb3c0f9fcb677e35f76b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T18:57:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/138ad913ab0cbd3091e81807e01bb3be6e433b18766bcb3c0f9fcb677e35f76b"}
{"level":"debug","ts":"2026-07-06T18:57:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"138ad913ab0cbd3091e81807e01bb3be6e433b18766bcb3c0f9fcb677e35f76b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:57:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/138ad913ab0cbd3091e81807e01bb3be6e433b18766bcb3c0f9fcb677e35f76b","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-06T18:57:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"138ad913ab0cbd3091e81807e01bb3be6e433b18766bcb3c0f9fcb677e35f76b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T18:57:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/138ad913ab0cbd3091e81807e01bb3be6e433b18766bcb3c0f9fcb677e35f76b"}
{"level":"debug","ts":"2026-07-06T18:57:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"138ad913ab0cbd3091e81807e01bb3be6e433b18766bcb3c0f9fcb677e35f76b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T18:57:52Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T18:57:52Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["138ad913ab0cbd3091e81807e01bb3be6e433b18766bcb3c0f9fcb677e35f76b"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T18:57:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"138ad913ab0cbd3091e81807e01bb3be6e433b18766bcb3c0f9fcb677e35f76b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:57:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"138ad913ab0cbd3091e81807e01bb3be6e433b18766bcb3c0f9fcb677e35f76b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T18:57:52Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T18:57:52Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-06T18:57:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/138ad913ab0cbd3091e81807e01bb3be6e433b18766bcb3c0f9fcb677e35f76b","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T18:57:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"138ad913ab0cbd3091e81807e01bb3be6e433b18766bcb3c0f9fcb677e35f76b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:57:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"138ad913ab0cbd3091e81807e01bb3be6e433b18766bcb3c0f9fcb677e35f76b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:57:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"138ad913ab0cbd3091e81807e01bb3be6e433b18766bcb3c0f9fcb677e35f76b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T18:57:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/138ad913ab0cbd3091e81807e01bb3be6e433b18766bcb3c0f9fcb677e35f76b"}
{"level":"debug","ts":"2026-07-06T18:57:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/138ad913ab0cbd3091e81807e01bb3be6e433b18766bcb3c0f9fcb677e35f76b","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-06T18:57:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"138ad913ab0cbd3091e81807e01bb3be6e433b18766bcb3c0f9fcb677e35f76b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T18:57:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/138ad913ab0cbd3091e81807e01bb3be6e433b18766bcb3c0f9fcb677e35f76b"}
{"level":"debug","ts":"2026-07-06T18:57:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"138ad913ab0cbd3091e81807e01bb3be6e433b18766bcb3c0f9fcb677e35f76b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T18:57:52Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T18:57:52Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["138ad913ab0cbd3091e81807e01bb3be6e433b18766bcb3c0f9fcb677e35f76b"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T18:57:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"138ad913ab0cbd3091e81807e01bb3be6e433b18766bcb3c0f9fcb677e35f76b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:57:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"138ad913ab0cbd3091e81807e01bb3be6e433b18766bcb3c0f9fcb677e35f76b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:57:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/138ad913ab0cbd3091e81807e01bb3be6e433b18766bcb3c0f9fcb677e35f76b","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T18:57:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/138ad913ab0cbd3091e81807e01bb3be6e433b18766bcb3c0f9fcb677e35f76b"}
{"level":"debug","ts":"2026-07-06T18:58:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"bfc4b7e1e0637131c0eb0d94a5551362a931c0c0b49d32453ea20ba4ef4e6dca","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T18:58:16Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T18:58:16Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-06T18:58:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/bfc4b7e1e0637131c0eb0d94a5551362a931c0c0b49d32453ea20ba4ef4e6dca","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T18:58:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"bfc4b7e1e0637131c0eb0d94a5551362a931c0c0b49d32453ea20ba4ef4e6dca","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:58:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"bfc4b7e1e0637131c0eb0d94a5551362a931c0c0b49d32453ea20ba4ef4e6dca","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T18:58:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/bfc4b7e1e0637131c0eb0d94a5551362a931c0c0b49d32453ea20ba4ef4e6dca"}
{"level":"debug","ts":"2026-07-06T18:58:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/bfc4b7e1e0637131c0eb0d94a5551362a931c0c0b49d32453ea20ba4ef4e6dca","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-06T18:58:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"bfc4b7e1e0637131c0eb0d94a5551362a931c0c0b49d32453ea20ba4ef4e6dca","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:58:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"bfc4b7e1e0637131c0eb0d94a5551362a931c0c0b49d32453ea20ba4ef4e6dca","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T18:58:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/bfc4b7e1e0637131c0eb0d94a5551362a931c0c0b49d32453ea20ba4ef4e6dca"}
{"level":"debug","ts":"2026-07-06T18:58:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"bfc4b7e1e0637131c0eb0d94a5551362a931c0c0b49d32453ea20ba4ef4e6dca","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T18:58:16Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T18:58:16Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["bfc4b7e1e0637131c0eb0d94a5551362a931c0c0b49d32453ea20ba4ef4e6dca"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T18:58:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"bfc4b7e1e0637131c0eb0d94a5551362a931c0c0b49d32453ea20ba4ef4e6dca","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:58:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"bfc4b7e1e0637131c0eb0d94a5551362a931c0c0b49d32453ea20ba4ef4e6dca","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:58:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/bfc4b7e1e0637131c0eb0d94a5551362a931c0c0b49d32453ea20ba4ef4e6dca","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T18:58:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/bfc4b7e1e0637131c0eb0d94a5551362a931c0c0b49d32453ea20ba4ef4e6dca"}
{"level":"debug","ts":"2026-07-06T18:58:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d9b74bf4758530ace9aa0e180114d409b7624657e3560e134966578eea78671d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T18:58:17Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T18:58:17Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-06T18:58:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/d9b74bf4758530ace9aa0e180114d409b7624657e3560e134966578eea78671d","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T18:58:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d9b74bf4758530ace9aa0e180114d409b7624657e3560e134966578eea78671d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T18:58:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d9b74bf4758530ace9aa0e180114d409b7624657e3560e134966578eea78671d"}
{"level":"debug","ts":"2026-07-06T18:58:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d9b74bf4758530ace9aa0e180114d409b7624657e3560e134966578eea78671d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T18:58:17Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T18:58:17Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-06T18:58:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/d9b74bf4758530ace9aa0e180114d409b7624657e3560e134966578eea78671d","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"error","ts":"2026-07-06T18:58:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"d9b74bf4758530ace9aa0e180114d409b7624657e3560e134966578eea78671d","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"d9b74bf4758530ace9aa0e180114d409b7624657e3560e134966578eea78671d\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-06T18:58:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d9b74bf4758530ace9aa0e180114d409b7624657e3560e134966578eea78671d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:58:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d9b74bf4758530ace9aa0e180114d409b7624657e3560e134966578eea78671d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T18:58:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d9b74bf4758530ace9aa0e180114d409b7624657e3560e134966578eea78671d"}
{"level":"debug","ts":"2026-07-06T18:58:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"07f9b7d247b651f0fb8926b5f6250b054abdd15be8c3a9d63573c4e8c0deae2f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T18:58:17Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T18:58:17Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-06T18:58:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/07f9b7d247b651f0fb8926b5f6250b054abdd15be8c3a9d63573c4e8c0deae2f","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T18:58:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"07f9b7d247b651f0fb8926b5f6250b054abdd15be8c3a9d63573c4e8c0deae2f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:58:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d9b74bf4758530ace9aa0e180114d409b7624657e3560e134966578eea78671d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T18:58:17Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T18:58:17Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["d9b74bf4758530ace9aa0e180114d409b7624657e3560e134966578eea78671d"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T18:58:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/07f9b7d247b651f0fb8926b5f6250b054abdd15be8c3a9d63573c4e8c0deae2f"}
{"level":"debug","ts":"2026-07-06T18:58:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/07f9b7d247b651f0fb8926b5f6250b054abdd15be8c3a9d63573c4e8c0deae2f","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T18:58:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d9b74bf4758530ace9aa0e180114d409b7624657e3560e134966578eea78671d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:58:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"07f9b7d247b651f0fb8926b5f6250b054abdd15be8c3a9d63573c4e8c0deae2f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:58:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d9b74bf4758530ace9aa0e180114d409b7624657e3560e134966578eea78671d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T18:58:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/07f9b7d247b651f0fb8926b5f6250b054abdd15be8c3a9d63573c4e8c0deae2f"}
{"level":"debug","ts":"2026-07-06T18:58:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"07f9b7d247b651f0fb8926b5f6250b054abdd15be8c3a9d63573c4e8c0deae2f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T18:58:17Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T18:58:17Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["07f9b7d247b651f0fb8926b5f6250b054abdd15be8c3a9d63573c4e8c0deae2f"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-06T18:58:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/d9b74bf4758530ace9aa0e180114d409b7624657e3560e134966578eea78671d","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T18:58:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d9b74bf4758530ace9aa0e180114d409b7624657e3560e134966578eea78671d"}
{"level":"info","ts":"2026-07-06T18:58:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"07f9b7d247b651f0fb8926b5f6250b054abdd15be8c3a9d63573c4e8c0deae2f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:58:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"07f9b7d247b651f0fb8926b5f6250b054abdd15be8c3a9d63573c4e8c0deae2f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T18:58:17Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T18:58:17Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-06T18:58:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/07f9b7d247b651f0fb8926b5f6250b054abdd15be8c3a9d63573c4e8c0deae2f","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T18:58:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"07f9b7d247b651f0fb8926b5f6250b054abdd15be8c3a9d63573c4e8c0deae2f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:58:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"07f9b7d247b651f0fb8926b5f6250b054abdd15be8c3a9d63573c4e8c0deae2f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:58:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"07f9b7d247b651f0fb8926b5f6250b054abdd15be8c3a9d63573c4e8c0deae2f","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T18:58:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/07f9b7d247b651f0fb8926b5f6250b054abdd15be8c3a9d63573c4e8c0deae2f"}
{"level":"debug","ts":"2026-07-06T18:58:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c6deaf5a9aef0f5d89a83ba21d793f2672685143d1359b58c37a4c58c2879779","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T18:58:17Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T18:58:17Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-06T18:58:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/c6deaf5a9aef0f5d89a83ba21d793f2672685143d1359b58c37a4c58c2879779","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T18:58:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c6deaf5a9aef0f5d89a83ba21d793f2672685143d1359b58c37a4c58c2879779","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:58:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c6deaf5a9aef0f5d89a83ba21d793f2672685143d1359b58c37a4c58c2879779","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:58:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"07f9b7d247b651f0fb8926b5f6250b054abdd15be8c3a9d63573c4e8c0deae2f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T18:58:17Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T18:58:17Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["07f9b7d247b651f0fb8926b5f6250b054abdd15be8c3a9d63573c4e8c0deae2f"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T18:58:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c6deaf5a9aef0f5d89a83ba21d793f2672685143d1359b58c37a4c58c2879779"}
{"level":"debug","ts":"2026-07-06T18:58:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/07f9b7d247b651f0fb8926b5f6250b054abdd15be8c3a9d63573c4e8c0deae2f","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T18:58:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"07f9b7d247b651f0fb8926b5f6250b054abdd15be8c3a9d63573c4e8c0deae2f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:58:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c6deaf5a9aef0f5d89a83ba21d793f2672685143d1359b58c37a4c58c2879779","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T18:58:17Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T18:58:17Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["c6deaf5a9aef0f5d89a83ba21d793f2672685143d1359b58c37a4c58c2879779"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T18:58:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/07f9b7d247b651f0fb8926b5f6250b054abdd15be8c3a9d63573c4e8c0deae2f"}
{"level":"info","ts":"2026-07-06T18:58:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c6deaf5a9aef0f5d89a83ba21d793f2672685143d1359b58c37a4c58c2879779","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:58:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"07f9b7d247b651f0fb8926b5f6250b054abdd15be8c3a9d63573c4e8c0deae2f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:58:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/c6deaf5a9aef0f5d89a83ba21d793f2672685143d1359b58c37a4c58c2879779","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-06T18:58:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c6deaf5a9aef0f5d89a83ba21d793f2672685143d1359b58c37a4c58c2879779","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T18:58:17Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T18:58:17Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T18:58:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c6deaf5a9aef0f5d89a83ba21d793f2672685143d1359b58c37a4c58c2879779"}
{"level":"debug","ts":"2026-07-06T18:58:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/07f9b7d247b651f0fb8926b5f6250b054abdd15be8c3a9d63573c4e8c0deae2f","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T18:58:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/07f9b7d247b651f0fb8926b5f6250b054abdd15be8c3a9d63573c4e8c0deae2f"}
{"level":"debug","ts":"2026-07-06T18:58:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/c6deaf5a9aef0f5d89a83ba21d793f2672685143d1359b58c37a4c58c2879779","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T18:58:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c6deaf5a9aef0f5d89a83ba21d793f2672685143d1359b58c37a4c58c2879779","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:58:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b117e5e69a18e70f9e3441e4d5a07d2a919a6ee947dcdfdd1c4c066a7351c20b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T18:58:17Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T18:58:17Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T18:58:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c6deaf5a9aef0f5d89a83ba21d793f2672685143d1359b58c37a4c58c2879779"}
{"level":"debug","ts":"2026-07-06T18:58:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/b117e5e69a18e70f9e3441e4d5a07d2a919a6ee947dcdfdd1c4c066a7351c20b","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T18:58:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b117e5e69a18e70f9e3441e4d5a07d2a919a6ee947dcdfdd1c4c066a7351c20b"}
{"level":"debug","ts":"2026-07-06T18:58:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/b117e5e69a18e70f9e3441e4d5a07d2a919a6ee947dcdfdd1c4c066a7351c20b","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T18:58:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b117e5e69a18e70f9e3441e4d5a07d2a919a6ee947dcdfdd1c4c066a7351c20b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:58:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c6deaf5a9aef0f5d89a83ba21d793f2672685143d1359b58c37a4c58c2879779","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T18:58:17Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T18:58:17Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["c6deaf5a9aef0f5d89a83ba21d793f2672685143d1359b58c37a4c58c2879779"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T18:58:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b117e5e69a18e70f9e3441e4d5a07d2a919a6ee947dcdfdd1c4c066a7351c20b"}
{"level":"debug","ts":"2026-07-06T18:58:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/7e68002ef8ebe7ec0f51cd08fa8fa79431fc0556ed871d55bf3217c250d120cc","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T18:58:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c6deaf5a9aef0f5d89a83ba21d793f2672685143d1359b58c37a4c58c2879779","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:58:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b117e5e69a18e70f9e3441e4d5a07d2a919a6ee947dcdfdd1c4c066a7351c20b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T18:58:17Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T18:58:17Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["b117e5e69a18e70f9e3441e4d5a07d2a919a6ee947dcdfdd1c4c066a7351c20b"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T18:58:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7e68002ef8ebe7ec0f51cd08fa8fa79431fc0556ed871d55bf3217c250d120cc"}
{"level":"debug","ts":"2026-07-06T18:58:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/c6deaf5a9aef0f5d89a83ba21d793f2672685143d1359b58c37a4c58c2879779","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T18:58:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c6deaf5a9aef0f5d89a83ba21d793f2672685143d1359b58c37a4c58c2879779"}
{"level":"info","ts":"2026-07-06T18:58:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b117e5e69a18e70f9e3441e4d5a07d2a919a6ee947dcdfdd1c4c066a7351c20b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:58:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7e68002ef8ebe7ec0f51cd08fa8fa79431fc0556ed871d55bf3217c250d120cc","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T18:58:17Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T18:58:17Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["7e68002ef8ebe7ec0f51cd08fa8fa79431fc0556ed871d55bf3217c250d120cc"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-06T18:58:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/b117e5e69a18e70f9e3441e4d5a07d2a919a6ee947dcdfdd1c4c066a7351c20b","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T18:58:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b117e5e69a18e70f9e3441e4d5a07d2a919a6ee947dcdfdd1c4c066a7351c20b"}
{"level":"debug","ts":"2026-07-06T18:58:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/7315248866efba0d19d2f53867bdfcb3918eae4d0cbd8a4561fa8fd22da09513","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T18:58:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7315248866efba0d19d2f53867bdfcb3918eae4d0cbd8a4561fa8fd22da09513"}
{"level":"debug","ts":"2026-07-06T18:58:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/4a0851213f51abc407d19ad1153df5b739fad41099b6d5979632a8f6692a7b90","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T18:58:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4a0851213f51abc407d19ad1153df5b739fad41099b6d5979632a8f6692a7b90"}
{"level":"debug","ts":"2026-07-06T18:58:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/7e68002ef8ebe7ec0f51cd08fa8fa79431fc0556ed871d55bf3217c250d120cc","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T18:58:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7e68002ef8ebe7ec0f51cd08fa8fa79431fc0556ed871d55bf3217c250d120cc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:58:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c6deaf5a9aef0f5d89a83ba21d793f2672685143d1359b58c37a4c58c2879779","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:58:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b117e5e69a18e70f9e3441e4d5a07d2a919a6ee947dcdfdd1c4c066a7351c20b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:58:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7315248866efba0d19d2f53867bdfcb3918eae4d0cbd8a4561fa8fd22da09513","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T18:58:17Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T18:58:17Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["7315248866efba0d19d2f53867bdfcb3918eae4d0cbd8a4561fa8fd22da09513"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T18:58:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7e68002ef8ebe7ec0f51cd08fa8fa79431fc0556ed871d55bf3217c250d120cc"}
{"level":"info","ts":"2026-07-06T18:58:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7315248866efba0d19d2f53867bdfcb3918eae4d0cbd8a4561fa8fd22da09513","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:58:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4a0851213f51abc407d19ad1153df5b739fad41099b6d5979632a8f6692a7b90","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T18:58:18Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T18:58:18Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["4a0851213f51abc407d19ad1153df5b739fad41099b6d5979632a8f6692a7b90"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-06T18:58:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/7315248866efba0d19d2f53867bdfcb3918eae4d0cbd8a4561fa8fd22da09513","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T18:58:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4a0851213f51abc407d19ad1153df5b739fad41099b6d5979632a8f6692a7b90","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:58:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7e68002ef8ebe7ec0f51cd08fa8fa79431fc0556ed871d55bf3217c250d120cc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:58:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7315248866efba0d19d2f53867bdfcb3918eae4d0cbd8a4561fa8fd22da09513","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T18:58:18Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T18:58:18Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T18:58:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7315248866efba0d19d2f53867bdfcb3918eae4d0cbd8a4561fa8fd22da09513"}
{"level":"debug","ts":"2026-07-06T18:58:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/4a0851213f51abc407d19ad1153df5b739fad41099b6d5979632a8f6692a7b90","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T18:58:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7315248866efba0d19d2f53867bdfcb3918eae4d0cbd8a4561fa8fd22da09513","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:58:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4a0851213f51abc407d19ad1153df5b739fad41099b6d5979632a8f6692a7b90","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T18:58:18Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T18:58:18Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T18:58:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4a0851213f51abc407d19ad1153df5b739fad41099b6d5979632a8f6692a7b90"}
{"level":"debug","ts":"2026-07-06T18:58:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/7315248866efba0d19d2f53867bdfcb3918eae4d0cbd8a4561fa8fd22da09513","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T18:58:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4a0851213f51abc407d19ad1153df5b739fad41099b6d5979632a8f6692a7b90","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:58:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7315248866efba0d19d2f53867bdfcb3918eae4d0cbd8a4561fa8fd22da09513","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:58:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4a0851213f51abc407d19ad1153df5b739fad41099b6d5979632a8f6692a7b90","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T18:58:18Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T18:58:18Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["4a0851213f51abc407d19ad1153df5b739fad41099b6d5979632a8f6692a7b90"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T18:58:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7315248866efba0d19d2f53867bdfcb3918eae4d0cbd8a4561fa8fd22da09513"}
{"level":"debug","ts":"2026-07-06T18:58:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/4a0851213f51abc407d19ad1153df5b739fad41099b6d5979632a8f6692a7b90","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T18:58:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4a0851213f51abc407d19ad1153df5b739fad41099b6d5979632a8f6692a7b90","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:58:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7315248866efba0d19d2f53867bdfcb3918eae4d0cbd8a4561fa8fd22da09513","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T18:58:18Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T18:58:18Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["7315248866efba0d19d2f53867bdfcb3918eae4d0cbd8a4561fa8fd22da09513"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T18:58:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4a0851213f51abc407d19ad1153df5b739fad41099b6d5979632a8f6692a7b90"}
{"level":"debug","ts":"2026-07-06T18:58:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/4a0851213f51abc407d19ad1153df5b739fad41099b6d5979632a8f6692a7b90","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T18:58:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7315248866efba0d19d2f53867bdfcb3918eae4d0cbd8a4561fa8fd22da09513","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:58:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4a0851213f51abc407d19ad1153df5b739fad41099b6d5979632a8f6692a7b90","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T18:58:18Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T18:58:18Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T18:58:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4a0851213f51abc407d19ad1153df5b739fad41099b6d5979632a8f6692a7b90"}
{"level":"debug","ts":"2026-07-06T18:58:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/7315248866efba0d19d2f53867bdfcb3918eae4d0cbd8a4561fa8fd22da09513","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T18:58:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4a0851213f51abc407d19ad1153df5b739fad41099b6d5979632a8f6692a7b90","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:58:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7315248866efba0d19d2f53867bdfcb3918eae4d0cbd8a4561fa8fd22da09513","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T18:58:18Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T18:58:18Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T18:58:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7315248866efba0d19d2f53867bdfcb3918eae4d0cbd8a4561fa8fd22da09513"}
{"level":"debug","ts":"2026-07-06T18:58:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/4a0851213f51abc407d19ad1153df5b739fad41099b6d5979632a8f6692a7b90","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T18:58:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7315248866efba0d19d2f53867bdfcb3918eae4d0cbd8a4561fa8fd22da09513","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:58:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4a0851213f51abc407d19ad1153df5b739fad41099b6d5979632a8f6692a7b90","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:58:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7315248866efba0d19d2f53867bdfcb3918eae4d0cbd8a4561fa8fd22da09513","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T18:58:18Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T18:58:18Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["7315248866efba0d19d2f53867bdfcb3918eae4d0cbd8a4561fa8fd22da09513"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T18:58:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7315248866efba0d19d2f53867bdfcb3918eae4d0cbd8a4561fa8fd22da09513","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:58:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4a0851213f51abc407d19ad1153df5b739fad41099b6d5979632a8f6692a7b90","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:58:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7315248866efba0d19d2f53867bdfcb3918eae4d0cbd8a4561fa8fd22da09513","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T18:58:18Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T18:58:18Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["7315248866efba0d19d2f53867bdfcb3918eae4d0cbd8a4561fa8fd22da09513"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T18:58:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4a0851213f51abc407d19ad1153df5b739fad41099b6d5979632a8f6692a7b90"}
{"level":"debug","ts":"2026-07-06T18:58:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/7315248866efba0d19d2f53867bdfcb3918eae4d0cbd8a4561fa8fd22da09513","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"error","ts":"2026-07-06T18:58:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"7315248866efba0d19d2f53867bdfcb3918eae4d0cbd8a4561fa8fd22da09513","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"7315248866efba0d19d2f53867bdfcb3918eae4d0cbd8a4561fa8fd22da09513\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-06T18:58:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7315248866efba0d19d2f53867bdfcb3918eae4d0cbd8a4561fa8fd22da09513","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T18:58:18Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T18:58:18Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T18:58:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7315248866efba0d19d2f53867bdfcb3918eae4d0cbd8a4561fa8fd22da09513","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:58:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4a0851213f51abc407d19ad1153df5b739fad41099b6d5979632a8f6692a7b90","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T18:58:18Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T18:58:18Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["4a0851213f51abc407d19ad1153df5b739fad41099b6d5979632a8f6692a7b90"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T18:58:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7315248866efba0d19d2f53867bdfcb3918eae4d0cbd8a4561fa8fd22da09513"}
{"level":"info","ts":"2026-07-06T18:58:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4a0851213f51abc407d19ad1153df5b739fad41099b6d5979632a8f6692a7b90","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:58:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7315248866efba0d19d2f53867bdfcb3918eae4d0cbd8a4561fa8fd22da09513","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:58:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4a0851213f51abc407d19ad1153df5b739fad41099b6d5979632a8f6692a7b90","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:58:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/7315248866efba0d19d2f53867bdfcb3918eae4d0cbd8a4561fa8fd22da09513","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-06T18:58:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7315248866efba0d19d2f53867bdfcb3918eae4d0cbd8a4561fa8fd22da09513","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T18:58:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7315248866efba0d19d2f53867bdfcb3918eae4d0cbd8a4561fa8fd22da09513"}
{"level":"debug","ts":"2026-07-06T18:58:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7315248866efba0d19d2f53867bdfcb3918eae4d0cbd8a4561fa8fd22da09513","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T18:58:18Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T18:58:18Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["7315248866efba0d19d2f53867bdfcb3918eae4d0cbd8a4561fa8fd22da09513"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-06T18:58:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/4a0851213f51abc407d19ad1153df5b739fad41099b6d5979632a8f6692a7b90","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T18:58:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7315248866efba0d19d2f53867bdfcb3918eae4d0cbd8a4561fa8fd22da09513","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:58:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7315248866efba0d19d2f53867bdfcb3918eae4d0cbd8a4561fa8fd22da09513","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T18:58:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4a0851213f51abc407d19ad1153df5b739fad41099b6d5979632a8f6692a7b90"}
{"level":"debug","ts":"2026-07-06T18:58:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/7315248866efba0d19d2f53867bdfcb3918eae4d0cbd8a4561fa8fd22da09513","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T18:58:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7315248866efba0d19d2f53867bdfcb3918eae4d0cbd8a4561fa8fd22da09513"}
{"level":"debug","ts":"2026-07-06T18:58:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"847f9857c9194bde9fa59bb12ca1c19030751765bcc282dddd8c9a1c0f3167da","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T18:58:31Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T18:58:31Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-06T18:58:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/847f9857c9194bde9fa59bb12ca1c19030751765bcc282dddd8c9a1c0f3167da","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T18:58:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"847f9857c9194bde9fa59bb12ca1c19030751765bcc282dddd8c9a1c0f3167da","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:58:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"847f9857c9194bde9fa59bb12ca1c19030751765bcc282dddd8c9a1c0f3167da","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:58:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"847f9857c9194bde9fa59bb12ca1c19030751765bcc282dddd8c9a1c0f3167da","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T18:58:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/847f9857c9194bde9fa59bb12ca1c19030751765bcc282dddd8c9a1c0f3167da"}
{"level":"debug","ts":"2026-07-06T18:58:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/847f9857c9194bde9fa59bb12ca1c19030751765bcc282dddd8c9a1c0f3167da","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-06T18:58:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"847f9857c9194bde9fa59bb12ca1c19030751765bcc282dddd8c9a1c0f3167da","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T18:58:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/847f9857c9194bde9fa59bb12ca1c19030751765bcc282dddd8c9a1c0f3167da"}
{"level":"debug","ts":"2026-07-06T18:58:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"847f9857c9194bde9fa59bb12ca1c19030751765bcc282dddd8c9a1c0f3167da","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T18:58:31Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T18:58:31Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["847f9857c9194bde9fa59bb12ca1c19030751765bcc282dddd8c9a1c0f3167da"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T18:58:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"847f9857c9194bde9fa59bb12ca1c19030751765bcc282dddd8c9a1c0f3167da","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:58:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"847f9857c9194bde9fa59bb12ca1c19030751765bcc282dddd8c9a1c0f3167da","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T18:58:31Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T18:58:31Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-06T18:58:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/847f9857c9194bde9fa59bb12ca1c19030751765bcc282dddd8c9a1c0f3167da","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T18:58:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"847f9857c9194bde9fa59bb12ca1c19030751765bcc282dddd8c9a1c0f3167da","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:58:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"847f9857c9194bde9fa59bb12ca1c19030751765bcc282dddd8c9a1c0f3167da","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:58:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"847f9857c9194bde9fa59bb12ca1c19030751765bcc282dddd8c9a1c0f3167da","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T18:58:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/847f9857c9194bde9fa59bb12ca1c19030751765bcc282dddd8c9a1c0f3167da"}
{"level":"debug","ts":"2026-07-06T18:58:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/847f9857c9194bde9fa59bb12ca1c19030751765bcc282dddd8c9a1c0f3167da","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-06T18:58:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"847f9857c9194bde9fa59bb12ca1c19030751765bcc282dddd8c9a1c0f3167da","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T18:58:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/847f9857c9194bde9fa59bb12ca1c19030751765bcc282dddd8c9a1c0f3167da"}
{"level":"debug","ts":"2026-07-06T18:58:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"847f9857c9194bde9fa59bb12ca1c19030751765bcc282dddd8c9a1c0f3167da","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T18:58:31Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T18:58:31Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["847f9857c9194bde9fa59bb12ca1c19030751765bcc282dddd8c9a1c0f3167da"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T18:58:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"847f9857c9194bde9fa59bb12ca1c19030751765bcc282dddd8c9a1c0f3167da","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:58:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"847f9857c9194bde9fa59bb12ca1c19030751765bcc282dddd8c9a1c0f3167da","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T18:58:31Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T18:58:31Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-06T18:58:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/847f9857c9194bde9fa59bb12ca1c19030751765bcc282dddd8c9a1c0f3167da","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T18:58:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"847f9857c9194bde9fa59bb12ca1c19030751765bcc282dddd8c9a1c0f3167da","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:58:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"847f9857c9194bde9fa59bb12ca1c19030751765bcc282dddd8c9a1c0f3167da","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:58:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"847f9857c9194bde9fa59bb12ca1c19030751765bcc282dddd8c9a1c0f3167da","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T18:58:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/847f9857c9194bde9fa59bb12ca1c19030751765bcc282dddd8c9a1c0f3167da"}
{"level":"debug","ts":"2026-07-06T18:58:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/847f9857c9194bde9fa59bb12ca1c19030751765bcc282dddd8c9a1c0f3167da","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-06T18:58:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"847f9857c9194bde9fa59bb12ca1c19030751765bcc282dddd8c9a1c0f3167da","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T18:58:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/847f9857c9194bde9fa59bb12ca1c19030751765bcc282dddd8c9a1c0f3167da"}
{"level":"debug","ts":"2026-07-06T18:58:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"847f9857c9194bde9fa59bb12ca1c19030751765bcc282dddd8c9a1c0f3167da","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T18:58:31Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T18:58:31Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["847f9857c9194bde9fa59bb12ca1c19030751765bcc282dddd8c9a1c0f3167da"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T18:58:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"847f9857c9194bde9fa59bb12ca1c19030751765bcc282dddd8c9a1c0f3167da","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:58:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"847f9857c9194bde9fa59bb12ca1c19030751765bcc282dddd8c9a1c0f3167da","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:58:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/847f9857c9194bde9fa59bb12ca1c19030751765bcc282dddd8c9a1c0f3167da","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T18:58:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/847f9857c9194bde9fa59bb12ca1c19030751765bcc282dddd8c9a1c0f3167da"}
{"level":"debug","ts":"2026-07-06T18:58:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"03ac742de3b54ad0743b12586f4f86301de57c3a271b812c31477b3a870867d3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:58:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/03ac742de3b54ad0743b12586f4f86301de57c3a271b812c31477b3a870867d3","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T18:58:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/03ac742de3b54ad0743b12586f4f86301de57c3a271b812c31477b3a870867d3"}
{"level":"debug","ts":"2026-07-06T18:58:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"dea3566aff50bf52fe2d7c8f29a39148d8b5d8c43bf7893cad800ca86a951771","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T18:58:31Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T18:58:31Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-06T18:58:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/dea3566aff50bf52fe2d7c8f29a39148d8b5d8c43bf7893cad800ca86a951771","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T18:58:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"dea3566aff50bf52fe2d7c8f29a39148d8b5d8c43bf7893cad800ca86a951771","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T18:58:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/dea3566aff50bf52fe2d7c8f29a39148d8b5d8c43bf7893cad800ca86a951771"}
{"level":"debug","ts":"2026-07-06T18:58:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"dea3566aff50bf52fe2d7c8f29a39148d8b5d8c43bf7893cad800ca86a951771","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T18:58:31Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T18:58:31Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["dea3566aff50bf52fe2d7c8f29a39148d8b5d8c43bf7893cad800ca86a951771"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-06T18:58:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/dea3566aff50bf52fe2d7c8f29a39148d8b5d8c43bf7893cad800ca86a951771","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T18:58:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"dea3566aff50bf52fe2d7c8f29a39148d8b5d8c43bf7893cad800ca86a951771","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:58:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"dea3566aff50bf52fe2d7c8f29a39148d8b5d8c43bf7893cad800ca86a951771","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T18:58:31Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T18:58:31Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T18:58:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/dea3566aff50bf52fe2d7c8f29a39148d8b5d8c43bf7893cad800ca86a951771"}
{"level":"debug","ts":"2026-07-06T18:58:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/dea3566aff50bf52fe2d7c8f29a39148d8b5d8c43bf7893cad800ca86a951771","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T18:58:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"dea3566aff50bf52fe2d7c8f29a39148d8b5d8c43bf7893cad800ca86a951771","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:58:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"dea3566aff50bf52fe2d7c8f29a39148d8b5d8c43bf7893cad800ca86a951771","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T18:58:31Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T18:58:31Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"error","ts":"2026-07-06T18:58:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"dea3566aff50bf52fe2d7c8f29a39148d8b5d8c43bf7893cad800ca86a951771","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"dea3566aff50bf52fe2d7c8f29a39148d8b5d8c43bf7893cad800ca86a951771\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-06T18:58:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"dea3566aff50bf52fe2d7c8f29a39148d8b5d8c43bf7893cad800ca86a951771","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T18:58:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/dea3566aff50bf52fe2d7c8f29a39148d8b5d8c43bf7893cad800ca86a951771"}
{"level":"debug","ts":"2026-07-06T18:58:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/dea3566aff50bf52fe2d7c8f29a39148d8b5d8c43bf7893cad800ca86a951771","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-06T18:58:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"dea3566aff50bf52fe2d7c8f29a39148d8b5d8c43bf7893cad800ca86a951771","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:58:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c6deaf5a9aef0f5d89a83ba21d793f2672685143d1359b58c37a4c58c2879779","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T18:58:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/dea3566aff50bf52fe2d7c8f29a39148d8b5d8c43bf7893cad800ca86a951771"}
{"level":"debug","ts":"2026-07-06T18:58:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/c6deaf5a9aef0f5d89a83ba21d793f2672685143d1359b58c37a4c58c2879779","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-06T18:58:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"dea3566aff50bf52fe2d7c8f29a39148d8b5d8c43bf7893cad800ca86a951771","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T18:58:31Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T18:58:31Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["dea3566aff50bf52fe2d7c8f29a39148d8b5d8c43bf7893cad800ca86a951771"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T18:58:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c6deaf5a9aef0f5d89a83ba21d793f2672685143d1359b58c37a4c58c2879779"}
{"level":"debug","ts":"2026-07-06T18:58:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/eb2791bd549e8278812cf508beb14dde3010dd6c48eb99afe00a94c55d9ae82a","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T18:58:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"dea3566aff50bf52fe2d7c8f29a39148d8b5d8c43bf7893cad800ca86a951771","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:58:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"eb2791bd549e8278812cf508beb14dde3010dd6c48eb99afe00a94c55d9ae82a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T18:58:31Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T18:58:31Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T18:58:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/eb2791bd549e8278812cf508beb14dde3010dd6c48eb99afe00a94c55d9ae82a"}
{"level":"debug","ts":"2026-07-06T18:58:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/dea3566aff50bf52fe2d7c8f29a39148d8b5d8c43bf7893cad800ca86a951771","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T18:58:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"eb2791bd549e8278812cf508beb14dde3010dd6c48eb99afe00a94c55d9ae82a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:58:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"dea3566aff50bf52fe2d7c8f29a39148d8b5d8c43bf7893cad800ca86a951771","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T18:58:31Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T18:58:31Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T18:58:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/dea3566aff50bf52fe2d7c8f29a39148d8b5d8c43bf7893cad800ca86a951771"}
{"level":"debug","ts":"2026-07-06T18:58:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/eb2791bd549e8278812cf508beb14dde3010dd6c48eb99afe00a94c55d9ae82a","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T18:58:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"dea3566aff50bf52fe2d7c8f29a39148d8b5d8c43bf7893cad800ca86a951771","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:58:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"eb2791bd549e8278812cf508beb14dde3010dd6c48eb99afe00a94c55d9ae82a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:58:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"dea3566aff50bf52fe2d7c8f29a39148d8b5d8c43bf7893cad800ca86a951771","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T18:58:31Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T18:58:31Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["dea3566aff50bf52fe2d7c8f29a39148d8b5d8c43bf7893cad800ca86a951771"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T18:58:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/eb2791bd549e8278812cf508beb14dde3010dd6c48eb99afe00a94c55d9ae82a"}
{"level":"debug","ts":"2026-07-06T18:58:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/dea3566aff50bf52fe2d7c8f29a39148d8b5d8c43bf7893cad800ca86a951771","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T18:58:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"dea3566aff50bf52fe2d7c8f29a39148d8b5d8c43bf7893cad800ca86a951771","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:58:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"eb2791bd549e8278812cf508beb14dde3010dd6c48eb99afe00a94c55d9ae82a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T18:58:31Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T18:58:31Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["eb2791bd549e8278812cf508beb14dde3010dd6c48eb99afe00a94c55d9ae82a"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T18:58:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"eb2791bd549e8278812cf508beb14dde3010dd6c48eb99afe00a94c55d9ae82a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:58:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"fc16a43a821191670fdc63ffb7bf3ff53176ccc44a4858cb008259a58b0f4d92","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:58:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"dea3566aff50bf52fe2d7c8f29a39148d8b5d8c43bf7893cad800ca86a951771","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T18:58:31Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T18:58:31Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T18:58:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/dea3566aff50bf52fe2d7c8f29a39148d8b5d8c43bf7893cad800ca86a951771"}
{"level":"debug","ts":"2026-07-06T18:58:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/fc16a43a821191670fdc63ffb7bf3ff53176ccc44a4858cb008259a58b0f4d92","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T18:58:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"dea3566aff50bf52fe2d7c8f29a39148d8b5d8c43bf7893cad800ca86a951771","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:58:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"eb2791bd549e8278812cf508beb14dde3010dd6c48eb99afe00a94c55d9ae82a","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T18:58:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/fc16a43a821191670fdc63ffb7bf3ff53176ccc44a4858cb008259a58b0f4d92"}
{"level":"debug","ts":"2026-07-06T18:58:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"dea3566aff50bf52fe2d7c8f29a39148d8b5d8c43bf7893cad800ca86a951771","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T18:58:31Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T18:58:31Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-06T18:58:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/dea3566aff50bf52fe2d7c8f29a39148d8b5d8c43bf7893cad800ca86a951771","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"error","ts":"2026-07-06T18:58:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"dea3566aff50bf52fe2d7c8f29a39148d8b5d8c43bf7893cad800ca86a951771","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"dea3566aff50bf52fe2d7c8f29a39148d8b5d8c43bf7893cad800ca86a951771\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-06T18:58:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"dea3566aff50bf52fe2d7c8f29a39148d8b5d8c43bf7893cad800ca86a951771","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:58:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"dea3566aff50bf52fe2d7c8f29a39148d8b5d8c43bf7893cad800ca86a951771","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T18:58:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/dea3566aff50bf52fe2d7c8f29a39148d8b5d8c43bf7893cad800ca86a951771"}
{"level":"debug","ts":"2026-07-06T18:58:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/eb2791bd549e8278812cf508beb14dde3010dd6c48eb99afe00a94c55d9ae82a","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-06T18:58:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4a0851213f51abc407d19ad1153df5b739fad41099b6d5979632a8f6692a7b90","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T18:58:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/eb2791bd549e8278812cf508beb14dde3010dd6c48eb99afe00a94c55d9ae82a"}
{"level":"debug","ts":"2026-07-06T18:58:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/dea3566aff50bf52fe2d7c8f29a39148d8b5d8c43bf7893cad800ca86a951771","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-06T18:58:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"dea3566aff50bf52fe2d7c8f29a39148d8b5d8c43bf7893cad800ca86a951771","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T18:58:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/dea3566aff50bf52fe2d7c8f29a39148d8b5d8c43bf7893cad800ca86a951771"}
{"level":"debug","ts":"2026-07-06T18:58:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/4a0851213f51abc407d19ad1153df5b739fad41099b6d5979632a8f6692a7b90","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T18:58:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4a0851213f51abc407d19ad1153df5b739fad41099b6d5979632a8f6692a7b90"}
{"level":"debug","ts":"2026-07-06T18:58:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b117e5e69a18e70f9e3441e4d5a07d2a919a6ee947dcdfdd1c4c066a7351c20b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T18:58:31Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T18:58:31Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-06T18:58:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/b117e5e69a18e70f9e3441e4d5a07d2a919a6ee947dcdfdd1c4c066a7351c20b","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T18:58:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b117e5e69a18e70f9e3441e4d5a07d2a919a6ee947dcdfdd1c4c066a7351c20b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:58:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"dea3566aff50bf52fe2d7c8f29a39148d8b5d8c43bf7893cad800ca86a951771","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T18:58:31Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T18:58:31Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["dea3566aff50bf52fe2d7c8f29a39148d8b5d8c43bf7893cad800ca86a951771"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T18:58:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b117e5e69a18e70f9e3441e4d5a07d2a919a6ee947dcdfdd1c4c066a7351c20b"}
{"level":"debug","ts":"2026-07-06T18:58:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/7e68002ef8ebe7ec0f51cd08fa8fa79431fc0556ed871d55bf3217c250d120cc","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T18:58:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"dea3566aff50bf52fe2d7c8f29a39148d8b5d8c43bf7893cad800ca86a951771","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:58:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b117e5e69a18e70f9e3441e4d5a07d2a919a6ee947dcdfdd1c4c066a7351c20b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T18:58:31Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T18:58:31Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["b117e5e69a18e70f9e3441e4d5a07d2a919a6ee947dcdfdd1c4c066a7351c20b"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T18:58:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7e68002ef8ebe7ec0f51cd08fa8fa79431fc0556ed871d55bf3217c250d120cc"}
{"level":"debug","ts":"2026-07-06T18:58:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/b117e5e69a18e70f9e3441e4d5a07d2a919a6ee947dcdfdd1c4c066a7351c20b","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T18:58:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b117e5e69a18e70f9e3441e4d5a07d2a919a6ee947dcdfdd1c4c066a7351c20b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:58:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7e68002ef8ebe7ec0f51cd08fa8fa79431fc0556ed871d55bf3217c250d120cc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:58:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"dea3566aff50bf52fe2d7c8f29a39148d8b5d8c43bf7893cad800ca86a951771","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:58:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b117e5e69a18e70f9e3441e4d5a07d2a919a6ee947dcdfdd1c4c066a7351c20b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T18:58:31Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T18:58:31Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T18:58:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b117e5e69a18e70f9e3441e4d5a07d2a919a6ee947dcdfdd1c4c066a7351c20b"}
{"level":"debug","ts":"2026-07-06T18:58:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/dea3566aff50bf52fe2d7c8f29a39148d8b5d8c43bf7893cad800ca86a951771","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T18:58:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b117e5e69a18e70f9e3441e4d5a07d2a919a6ee947dcdfdd1c4c066a7351c20b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:58:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b117e5e69a18e70f9e3441e4d5a07d2a919a6ee947dcdfdd1c4c066a7351c20b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T18:58:31Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T18:58:31Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["b117e5e69a18e70f9e3441e4d5a07d2a919a6ee947dcdfdd1c4c066a7351c20b"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T18:58:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/dea3566aff50bf52fe2d7c8f29a39148d8b5d8c43bf7893cad800ca86a951771"}
{"level":"debug","ts":"2026-07-06T18:58:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/b117e5e69a18e70f9e3441e4d5a07d2a919a6ee947dcdfdd1c4c066a7351c20b","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T18:58:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b117e5e69a18e70f9e3441e4d5a07d2a919a6ee947dcdfdd1c4c066a7351c20b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:58:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7315248866efba0d19d2f53867bdfcb3918eae4d0cbd8a4561fa8fd22da09513","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:58:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b117e5e69a18e70f9e3441e4d5a07d2a919a6ee947dcdfdd1c4c066a7351c20b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:58:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b117e5e69a18e70f9e3441e4d5a07d2a919a6ee947dcdfdd1c4c066a7351c20b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T18:58:32Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T18:58:32Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T18:58:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b117e5e69a18e70f9e3441e4d5a07d2a919a6ee947dcdfdd1c4c066a7351c20b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:58:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b117e5e69a18e70f9e3441e4d5a07d2a919a6ee947dcdfdd1c4c066a7351c20b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T18:58:32Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T18:58:32Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T18:58:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b117e5e69a18e70f9e3441e4d5a07d2a919a6ee947dcdfdd1c4c066a7351c20b"}
{"level":"debug","ts":"2026-07-06T18:58:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/7315248866efba0d19d2f53867bdfcb3918eae4d0cbd8a4561fa8fd22da09513","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"error","ts":"2026-07-06T18:58:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"b117e5e69a18e70f9e3441e4d5a07d2a919a6ee947dcdfdd1c4c066a7351c20b","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"b117e5e69a18e70f9e3441e4d5a07d2a919a6ee947dcdfdd1c4c066a7351c20b\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-06T18:58:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b117e5e69a18e70f9e3441e4d5a07d2a919a6ee947dcdfdd1c4c066a7351c20b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T18:58:32Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T18:58:32Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["b117e5e69a18e70f9e3441e4d5a07d2a919a6ee947dcdfdd1c4c066a7351c20b"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T18:58:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b117e5e69a18e70f9e3441e4d5a07d2a919a6ee947dcdfdd1c4c066a7351c20b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:58:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b117e5e69a18e70f9e3441e4d5a07d2a919a6ee947dcdfdd1c4c066a7351c20b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T18:58:32Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T18:58:32Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["b117e5e69a18e70f9e3441e4d5a07d2a919a6ee947dcdfdd1c4c066a7351c20b"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T18:58:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7315248866efba0d19d2f53867bdfcb3918eae4d0cbd8a4561fa8fd22da09513"}
{"level":"error","ts":"2026-07-06T18:58:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"b117e5e69a18e70f9e3441e4d5a07d2a919a6ee947dcdfdd1c4c066a7351c20b","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"b117e5e69a18e70f9e3441e4d5a07d2a919a6ee947dcdfdd1c4c066a7351c20b\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-06T18:58:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b117e5e69a18e70f9e3441e4d5a07d2a919a6ee947dcdfdd1c4c066a7351c20b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T18:58:32Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T18:58:32Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-06T18:58:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/b117e5e69a18e70f9e3441e4d5a07d2a919a6ee947dcdfdd1c4c066a7351c20b","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T18:58:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b117e5e69a18e70f9e3441e4d5a07d2a919a6ee947dcdfdd1c4c066a7351c20b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:58:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b117e5e69a18e70f9e3441e4d5a07d2a919a6ee947dcdfdd1c4c066a7351c20b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T18:58:32Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T18:58:32Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T18:58:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b117e5e69a18e70f9e3441e4d5a07d2a919a6ee947dcdfdd1c4c066a7351c20b"}
{"level":"debug","ts":"2026-07-06T18:58:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/b117e5e69a18e70f9e3441e4d5a07d2a919a6ee947dcdfdd1c4c066a7351c20b","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"error","ts":"2026-07-06T18:58:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"b117e5e69a18e70f9e3441e4d5a07d2a919a6ee947dcdfdd1c4c066a7351c20b","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"b117e5e69a18e70f9e3441e4d5a07d2a919a6ee947dcdfdd1c4c066a7351c20b\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-06T18:58:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b117e5e69a18e70f9e3441e4d5a07d2a919a6ee947dcdfdd1c4c066a7351c20b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T18:58:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b117e5e69a18e70f9e3441e4d5a07d2a919a6ee947dcdfdd1c4c066a7351c20b"}
{"level":"debug","ts":"2026-07-06T18:58:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b117e5e69a18e70f9e3441e4d5a07d2a919a6ee947dcdfdd1c4c066a7351c20b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T18:58:32Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T18:58:32Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["b117e5e69a18e70f9e3441e4d5a07d2a919a6ee947dcdfdd1c4c066a7351c20b"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-06T18:58:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/bfc4b7e1e0637131c0eb0d94a5551362a931c0c0b49d32453ea20ba4ef4e6dca","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T18:58:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b117e5e69a18e70f9e3441e4d5a07d2a919a6ee947dcdfdd1c4c066a7351c20b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:58:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"bfc4b7e1e0637131c0eb0d94a5551362a931c0c0b49d32453ea20ba4ef4e6dca","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T18:58:32Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T18:58:32Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T18:58:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/bfc4b7e1e0637131c0eb0d94a5551362a931c0c0b49d32453ea20ba4ef4e6dca"}
{"level":"debug","ts":"2026-07-06T18:58:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/b117e5e69a18e70f9e3441e4d5a07d2a919a6ee947dcdfdd1c4c066a7351c20b","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T18:58:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"bfc4b7e1e0637131c0eb0d94a5551362a931c0c0b49d32453ea20ba4ef4e6dca","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:58:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b117e5e69a18e70f9e3441e4d5a07d2a919a6ee947dcdfdd1c4c066a7351c20b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T18:58:32Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T18:58:32Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T18:58:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b117e5e69a18e70f9e3441e4d5a07d2a919a6ee947dcdfdd1c4c066a7351c20b"}
{"level":"info","ts":"2026-07-06T18:58:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b117e5e69a18e70f9e3441e4d5a07d2a919a6ee947dcdfdd1c4c066a7351c20b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:58:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"bfc4b7e1e0637131c0eb0d94a5551362a931c0c0b49d32453ea20ba4ef4e6dca","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:58:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b117e5e69a18e70f9e3441e4d5a07d2a919a6ee947dcdfdd1c4c066a7351c20b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T18:58:32Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T18:58:32Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["b117e5e69a18e70f9e3441e4d5a07d2a919a6ee947dcdfdd1c4c066a7351c20b"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-06T18:58:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/bfc4b7e1e0637131c0eb0d94a5551362a931c0c0b49d32453ea20ba4ef4e6dca","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T18:58:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b117e5e69a18e70f9e3441e4d5a07d2a919a6ee947dcdfdd1c4c066a7351c20b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:58:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"bfc4b7e1e0637131c0eb0d94a5551362a931c0c0b49d32453ea20ba4ef4e6dca","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:58:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b117e5e69a18e70f9e3441e4d5a07d2a919a6ee947dcdfdd1c4c066a7351c20b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T18:58:32Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T18:58:32Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["b117e5e69a18e70f9e3441e4d5a07d2a919a6ee947dcdfdd1c4c066a7351c20b"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"error","ts":"2026-07-06T18:58:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"b117e5e69a18e70f9e3441e4d5a07d2a919a6ee947dcdfdd1c4c066a7351c20b","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"b117e5e69a18e70f9e3441e4d5a07d2a919a6ee947dcdfdd1c4c066a7351c20b\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-06T18:58:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b117e5e69a18e70f9e3441e4d5a07d2a919a6ee947dcdfdd1c4c066a7351c20b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T18:58:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/bfc4b7e1e0637131c0eb0d94a5551362a931c0c0b49d32453ea20ba4ef4e6dca"}
{"level":"debug","ts":"2026-07-06T18:58:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/b117e5e69a18e70f9e3441e4d5a07d2a919a6ee947dcdfdd1c4c066a7351c20b","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-06T18:58:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b117e5e69a18e70f9e3441e4d5a07d2a919a6ee947dcdfdd1c4c066a7351c20b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T18:58:32Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T18:58:32Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T18:58:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b117e5e69a18e70f9e3441e4d5a07d2a919a6ee947dcdfdd1c4c066a7351c20b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:58:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"bfc4b7e1e0637131c0eb0d94a5551362a931c0c0b49d32453ea20ba4ef4e6dca","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T18:58:32Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T18:58:32Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["bfc4b7e1e0637131c0eb0d94a5551362a931c0c0b49d32453ea20ba4ef4e6dca"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T18:58:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b117e5e69a18e70f9e3441e4d5a07d2a919a6ee947dcdfdd1c4c066a7351c20b"}
{"level":"debug","ts":"2026-07-06T18:58:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/b117e5e69a18e70f9e3441e4d5a07d2a919a6ee947dcdfdd1c4c066a7351c20b","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T18:58:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"bfc4b7e1e0637131c0eb0d94a5551362a931c0c0b49d32453ea20ba4ef4e6dca","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:58:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b117e5e69a18e70f9e3441e4d5a07d2a919a6ee947dcdfdd1c4c066a7351c20b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:58:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"bfc4b7e1e0637131c0eb0d94a5551362a931c0c0b49d32453ea20ba4ef4e6dca","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:58:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b117e5e69a18e70f9e3441e4d5a07d2a919a6ee947dcdfdd1c4c066a7351c20b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T18:58:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b117e5e69a18e70f9e3441e4d5a07d2a919a6ee947dcdfdd1c4c066a7351c20b"}
{"level":"debug","ts":"2026-07-06T18:58:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/bfc4b7e1e0637131c0eb0d94a5551362a931c0c0b49d32453ea20ba4ef4e6dca","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-06T18:58:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b117e5e69a18e70f9e3441e4d5a07d2a919a6ee947dcdfdd1c4c066a7351c20b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T18:58:32Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T18:58:32Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["b117e5e69a18e70f9e3441e4d5a07d2a919a6ee947dcdfdd1c4c066a7351c20b"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T18:58:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/bfc4b7e1e0637131c0eb0d94a5551362a931c0c0b49d32453ea20ba4ef4e6dca"}
{"level":"info","ts":"2026-07-06T18:58:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b117e5e69a18e70f9e3441e4d5a07d2a919a6ee947dcdfdd1c4c066a7351c20b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:58:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b117e5e69a18e70f9e3441e4d5a07d2a919a6ee947dcdfdd1c4c066a7351c20b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T18:58:32Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T18:58:32Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-06T18:58:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/b117e5e69a18e70f9e3441e4d5a07d2a919a6ee947dcdfdd1c4c066a7351c20b","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T18:58:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b117e5e69a18e70f9e3441e4d5a07d2a919a6ee947dcdfdd1c4c066a7351c20b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:58:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"cbee4de24e7f52377467bc1c31e35371aa80bf91cd74077a1bc0ff135956cb05","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:58:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b117e5e69a18e70f9e3441e4d5a07d2a919a6ee947dcdfdd1c4c066a7351c20b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:58:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b117e5e69a18e70f9e3441e4d5a07d2a919a6ee947dcdfdd1c4c066a7351c20b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T18:58:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b117e5e69a18e70f9e3441e4d5a07d2a919a6ee947dcdfdd1c4c066a7351c20b"}
{"level":"debug","ts":"2026-07-06T18:58:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/cbee4de24e7f52377467bc1c31e35371aa80bf91cd74077a1bc0ff135956cb05","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-06T18:58:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b117e5e69a18e70f9e3441e4d5a07d2a919a6ee947dcdfdd1c4c066a7351c20b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T18:58:32Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T18:58:32Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["b117e5e69a18e70f9e3441e4d5a07d2a919a6ee947dcdfdd1c4c066a7351c20b"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T18:58:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/cbee4de24e7f52377467bc1c31e35371aa80bf91cd74077a1bc0ff135956cb05"}
{"level":"debug","ts":"2026-07-06T18:58:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/b117e5e69a18e70f9e3441e4d5a07d2a919a6ee947dcdfdd1c4c066a7351c20b","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T18:58:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b117e5e69a18e70f9e3441e4d5a07d2a919a6ee947dcdfdd1c4c066a7351c20b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:58:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b117e5e69a18e70f9e3441e4d5a07d2a919a6ee947dcdfdd1c4c066a7351c20b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T18:58:32Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T18:58:32Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T18:58:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b117e5e69a18e70f9e3441e4d5a07d2a919a6ee947dcdfdd1c4c066a7351c20b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:58:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b117e5e69a18e70f9e3441e4d5a07d2a919a6ee947dcdfdd1c4c066a7351c20b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:58:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b117e5e69a18e70f9e3441e4d5a07d2a919a6ee947dcdfdd1c4c066a7351c20b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:58:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5a9d65c5701fb29718b4291333482e202ccca1ec287d466e5bbc52ac71e6f97d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T18:58:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b117e5e69a18e70f9e3441e4d5a07d2a919a6ee947dcdfdd1c4c066a7351c20b"}
{"level":"debug","ts":"2026-07-06T18:58:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b117e5e69a18e70f9e3441e4d5a07d2a919a6ee947dcdfdd1c4c066a7351c20b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T18:58:32Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T18:58:32Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["b117e5e69a18e70f9e3441e4d5a07d2a919a6ee947dcdfdd1c4c066a7351c20b"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-06T18:58:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/5a9d65c5701fb29718b4291333482e202ccca1ec287d466e5bbc52ac71e6f97d","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T18:58:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b117e5e69a18e70f9e3441e4d5a07d2a919a6ee947dcdfdd1c4c066a7351c20b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:58:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b117e5e69a18e70f9e3441e4d5a07d2a919a6ee947dcdfdd1c4c066a7351c20b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:58:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"825b4e4809451f9debccbe1150b699f739c117934b0bf98871cc2a21cd18800d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T18:58:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5a9d65c5701fb29718b4291333482e202ccca1ec287d466e5bbc52ac71e6f97d"}
{"level":"debug","ts":"2026-07-06T18:58:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/b117e5e69a18e70f9e3441e4d5a07d2a919a6ee947dcdfdd1c4c066a7351c20b","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T18:58:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b117e5e69a18e70f9e3441e4d5a07d2a919a6ee947dcdfdd1c4c066a7351c20b"}
{"level":"debug","ts":"2026-07-06T18:58:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/825b4e4809451f9debccbe1150b699f739c117934b0bf98871cc2a21cd18800d","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T18:58:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/825b4e4809451f9debccbe1150b699f739c117934b0bf98871cc2a21cd18800d"}
{"level":"debug","ts":"2026-07-06T18:58:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"86345123ead4f37c7ec089e50cf7cc6cbfc5de47b541dbabfaa88510bcb6732b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T18:58:32Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T18:58:32Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-06T18:58:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/86345123ead4f37c7ec089e50cf7cc6cbfc5de47b541dbabfaa88510bcb6732b","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T18:58:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"86345123ead4f37c7ec089e50cf7cc6cbfc5de47b541dbabfaa88510bcb6732b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:58:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"86345123ead4f37c7ec089e50cf7cc6cbfc5de47b541dbabfaa88510bcb6732b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:58:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"138ad913ab0cbd3091e81807e01bb3be6e433b18766bcb3c0f9fcb677e35f76b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:58:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"86345123ead4f37c7ec089e50cf7cc6cbfc5de47b541dbabfaa88510bcb6732b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T18:58:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/86345123ead4f37c7ec089e50cf7cc6cbfc5de47b541dbabfaa88510bcb6732b"}
{"level":"debug","ts":"2026-07-06T18:58:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/138ad913ab0cbd3091e81807e01bb3be6e433b18766bcb3c0f9fcb677e35f76b","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-06T18:58:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"86345123ead4f37c7ec089e50cf7cc6cbfc5de47b541dbabfaa88510bcb6732b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T18:58:32Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T18:58:32Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["86345123ead4f37c7ec089e50cf7cc6cbfc5de47b541dbabfaa88510bcb6732b"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T18:58:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/138ad913ab0cbd3091e81807e01bb3be6e433b18766bcb3c0f9fcb677e35f76b"}
{"level":"debug","ts":"2026-07-06T18:58:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/86345123ead4f37c7ec089e50cf7cc6cbfc5de47b541dbabfaa88510bcb6732b","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T18:58:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"86345123ead4f37c7ec089e50cf7cc6cbfc5de47b541dbabfaa88510bcb6732b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:58:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"86345123ead4f37c7ec089e50cf7cc6cbfc5de47b541dbabfaa88510bcb6732b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T18:58:32Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T18:58:32Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T18:58:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/86345123ead4f37c7ec089e50cf7cc6cbfc5de47b541dbabfaa88510bcb6732b"}
{"level":"debug","ts":"2026-07-06T18:58:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/86345123ead4f37c7ec089e50cf7cc6cbfc5de47b541dbabfaa88510bcb6732b","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T18:58:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"86345123ead4f37c7ec089e50cf7cc6cbfc5de47b541dbabfaa88510bcb6732b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:58:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"86345123ead4f37c7ec089e50cf7cc6cbfc5de47b541dbabfaa88510bcb6732b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:58:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"86345123ead4f37c7ec089e50cf7cc6cbfc5de47b541dbabfaa88510bcb6732b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:58:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f7a881610c8fda197c39df80005b3793951a6331228f22cdc9803b8d8896142a","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T18:58:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/86345123ead4f37c7ec089e50cf7cc6cbfc5de47b541dbabfaa88510bcb6732b"}
{"level":"debug","ts":"2026-07-06T18:58:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/f7a881610c8fda197c39df80005b3793951a6331228f22cdc9803b8d8896142a","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-06T18:58:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"86345123ead4f37c7ec089e50cf7cc6cbfc5de47b541dbabfaa88510bcb6732b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T18:58:32Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T18:58:32Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["86345123ead4f37c7ec089e50cf7cc6cbfc5de47b541dbabfaa88510bcb6732b"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T18:58:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"86345123ead4f37c7ec089e50cf7cc6cbfc5de47b541dbabfaa88510bcb6732b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:58:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"fbdc0f099c5f0482cf8bd22695623cde02d28b9fbf8f0e782579fad6bdd9083a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:58:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"86345123ead4f37c7ec089e50cf7cc6cbfc5de47b541dbabfaa88510bcb6732b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T18:58:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f7a881610c8fda197c39df80005b3793951a6331228f22cdc9803b8d8896142a"}
{"level":"debug","ts":"2026-07-06T18:58:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/86345123ead4f37c7ec089e50cf7cc6cbfc5de47b541dbabfaa88510bcb6732b","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-06T18:58:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"07f9b7d247b651f0fb8926b5f6250b054abdd15be8c3a9d63573c4e8c0deae2f","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T18:58:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/86345123ead4f37c7ec089e50cf7cc6cbfc5de47b541dbabfaa88510bcb6732b"}
{"level":"debug","ts":"2026-07-06T18:58:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/fbdc0f099c5f0482cf8bd22695623cde02d28b9fbf8f0e782579fad6bdd9083a","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T18:58:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/fbdc0f099c5f0482cf8bd22695623cde02d28b9fbf8f0e782579fad6bdd9083a"}
{"level":"debug","ts":"2026-07-06T18:58:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/07f9b7d247b651f0fb8926b5f6250b054abdd15be8c3a9d63573c4e8c0deae2f","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-06T18:58:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d9b74bf4758530ace9aa0e180114d409b7624657e3560e134966578eea78671d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T18:58:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/07f9b7d247b651f0fb8926b5f6250b054abdd15be8c3a9d63573c4e8c0deae2f"}
{"level":"debug","ts":"2026-07-06T18:58:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/d9b74bf4758530ace9aa0e180114d409b7624657e3560e134966578eea78671d","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T18:58:32Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d9b74bf4758530ace9aa0e180114d409b7624657e3560e134966578eea78671d"}
{"level":"info","ts":"2026-07-06T18:58:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6006dc8c-0c5c-42a7-82ef-b33a8885045a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:49002","PortSpecifier":{"PortValue":49002}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.66:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"6006dc8c-0c5c-42a7-82ef-b33a8885045a","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-47f1eb.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T18:58:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6006dc8c-0c5c-42a7-82ef-b33a8885045a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:49002","PortSpecifier":{"PortValue":49002}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.66:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783364316,"nanos":358817773},"http":{"id":"6006dc8c-0c5c-42a7-82ef-b33a8885045a","method":"POST","headers":{":authority":"e2e-shared-a-47f1eb.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T18:58:36Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"6006dc8c-0c5c-42a7-82ef-b33a8885045a","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-07-06T18:58:36Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"6006dc8c-0c5c-42a7-82ef-b33a8885045a","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-06T18:58:36Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"6006dc8c-0c5c-42a7-82ef-b33a8885045a","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"4c117213-6436-4d5e-b6f2-0dc80354b8ad","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=b4ed87fd-f39c-46f5-8b5f-dad8294f1243"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/6aa6542dfc28"]}}
{"level":"debug","ts":"2026-07-06T18:58:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"6006dc8c-0c5c-42a7-82ef-b33a8885045a","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/6aa6542dfc28"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=b4ed87fd-f39c-46f5-8b5f-dad8294f1243"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"4c117213-6436-4d5e-b6f2-0dc80354b8ad","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"825b4e4809451f9debccbe1150b699f739c117934b0bf98871cc2a21cd18800d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.66:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-47f1eb.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T18:58:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6006dc8c-0c5c-42a7-82ef-b33a8885045a","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T18:58:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6006dc8c-0c5c-42a7-82ef-b33a8885045a","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T18:58:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6006dc8c-0c5c-42a7-82ef-b33a8885045a","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-47f1eb/sub-test-model-47f1eb\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T18:58:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"6006dc8c-0c5c-42a7-82ef-b33a8885045a","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-06T18:58:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6006dc8c-0c5c-42a7-82ef-b33a8885045a","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-06T18:58:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6006dc8c-0c5c-42a7-82ef-b33a8885045a","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-06T18:58:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6006dc8c-0c5c-42a7-82ef-b33a8885045a","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T18:58:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6006dc8c-0c5c-42a7-82ef-b33a8885045a","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T18:58:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"12036612-aa3d-45a6-9e7c-b0bea69464fd","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:35566","PortSpecifier":{"PortValue":35566}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.67:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"12036612-aa3d-45a6-9e7c-b0bea69464fd","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-b19850.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T18:58:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"12036612-aa3d-45a6-9e7c-b0bea69464fd","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:35566","PortSpecifier":{"PortValue":35566}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.67:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783364316,"nanos":407096234},"http":{"id":"12036612-aa3d-45a6-9e7c-b0bea69464fd","method":"POST","headers":{":authority":"e2e-shared-b-b19850.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T18:58:36Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"12036612-aa3d-45a6-9e7c-b0bea69464fd","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-07-06T18:58:36Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"12036612-aa3d-45a6-9e7c-b0bea69464fd","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-06T18:58:36Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"12036612-aa3d-45a6-9e7c-b0bea69464fd","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"4c117213-6436-4d5e-b6f2-0dc80354b8ad","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=b4ed87fd-f39c-46f5-8b5f-dad8294f1243"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/6aa6542dfc28"]}}
{"level":"debug","ts":"2026-07-06T18:58:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"12036612-aa3d-45a6-9e7c-b0bea69464fd","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/6aa6542dfc28"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=b4ed87fd-f39c-46f5-8b5f-dad8294f1243"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"4c117213-6436-4d5e-b6f2-0dc80354b8ad","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"cbee4de24e7f52377467bc1c31e35371aa80bf91cd74077a1bc0ff135956cb05"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.67:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-b19850.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T18:58:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"12036612-aa3d-45a6-9e7c-b0bea69464fd","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T18:58:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"12036612-aa3d-45a6-9e7c-b0bea69464fd","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T18:58:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"12036612-aa3d-45a6-9e7c-b0bea69464fd","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-b19850/sub-test-model-b19850\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T18:58:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"12036612-aa3d-45a6-9e7c-b0bea69464fd","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-06T18:58:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"12036612-aa3d-45a6-9e7c-b0bea69464fd","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-06T18:58:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"12036612-aa3d-45a6-9e7c-b0bea69464fd","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-06T18:58:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"12036612-aa3d-45a6-9e7c-b0bea69464fd","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T18:58:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"12036612-aa3d-45a6-9e7c-b0bea69464fd","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T18:58:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6ac9464f-2247-472d-aaae-2d2db4de0a24","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:49004","PortSpecifier":{"PortValue":49004}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.66:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"6ac9464f-2247-472d-aaae-2d2db4de0a24","method":"GET","path":"/maas-api/v1/subscriptions","host":"e2e-shared-a-47f1eb.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T18:58:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6ac9464f-2247-472d-aaae-2d2db4de0a24","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:49004","PortSpecifier":{"PortValue":49004}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.66:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783364316,"nanos":455044578},"http":{"id":"6ac9464f-2247-472d-aaae-2d2db4de0a24","method":"GET","headers":{":authority":"e2e-shared-a-47f1eb.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/subscriptions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T18:58:36Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"6ac9464f-2247-472d-aaae-2d2db4de0a24","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1dq23JzDmbTGCycuJ_u2JmXZqYLv9euKeXimixgyt3nfqYe7tXHnMmnPDRSPo"}
{"level":"debug","ts":"2026-07-06T18:58:36Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"6ac9464f-2247-472d-aaae-2d2db4de0a24","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-47f1eb.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1dq23JzDmbTGCycuJ_u2JmXZqYLv9euKeXimixgyt3nfqYe7tXHnMmnPDRSPo\"}"}
{"level":"debug","ts":"2026-07-06T18:58:36Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"6ac9464f-2247-472d-aaae-2d2db4de0a24","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-47f1eb.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"7a7cf642-052d-49b3-9ce1-dadc178edda1","keyName":"e2e-sub-iso-3c3300","subscription":"e2e-a-only-1d0e70","tenant":"e2e-shared-a-47f1eb","userId":"7a7cf642-052d-49b3-9ce1-dadc178edda1","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-06T18:58:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"6ac9464f-2247-472d-aaae-2d2db4de0a24","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T18:58:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6ac9464f-2247-472d-aaae-2d2db4de0a24","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T18:58:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6ac9464f-2247-472d-aaae-2d2db4de0a24","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T18:58:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6ac9464f-2247-472d-aaae-2d2db4de0a24","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-47f1eb/sub-test-model-47f1eb\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T18:58:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6ac9464f-2247-472d-aaae-2d2db4de0a24","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-06T18:58:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6ac9464f-2247-472d-aaae-2d2db4de0a24","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-a-only-1d0e70"}
{"level":"debug","ts":"2026-07-06T18:58:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6ac9464f-2247-472d-aaae-2d2db4de0a24","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-06T18:58:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"6ac9464f-2247-472d-aaae-2d2db4de0a24","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-06T18:58:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6ac9464f-2247-472d-aaae-2d2db4de0a24","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T18:58:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6ac9464f-2247-472d-aaae-2d2db4de0a24","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T18:58:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8e66238e-8522-4c11-8c6a-9d3f81178bfd","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:35576","PortSpecifier":{"PortValue":35576}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.67:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"8e66238e-8522-4c11-8c6a-9d3f81178bfd","method":"GET","path":"/maas-api/v1/subscriptions","host":"e2e-shared-b-b19850.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T18:58:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8e66238e-8522-4c11-8c6a-9d3f81178bfd","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:35576","PortSpecifier":{"PortValue":35576}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.67:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783364316,"nanos":504471539},"http":{"id":"8e66238e-8522-4c11-8c6a-9d3f81178bfd","method":"GET","headers":{":authority":"e2e-shared-b-b19850.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/subscriptions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T18:58:36Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"8e66238e-8522-4c11-8c6a-9d3f81178bfd","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1Y4roq0HaGyF9ArQw_oEGMvua8stLjWMBM04Yzft8WbDjxEtopMTo6kYed2xh"}
{"level":"debug","ts":"2026-07-06T18:58:36Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"8e66238e-8522-4c11-8c6a-9d3f81178bfd","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-b-b19850.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1Y4roq0HaGyF9ArQw_oEGMvua8stLjWMBM04Yzft8WbDjxEtopMTo6kYed2xh\"}"}
{"level":"debug","ts":"2026-07-06T18:58:36Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"8e66238e-8522-4c11-8c6a-9d3f81178bfd","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-b19850.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"15e0ef4a-1931-4120-b419-decdbed2ac28","keyName":"e2e-sub-iso-0f4cd6","subscription":"e2e-b-only-1d0e70","tenant":"e2e-shared-b-b19850","userId":"15e0ef4a-1931-4120-b419-decdbed2ac28","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-06T18:58:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"8e66238e-8522-4c11-8c6a-9d3f81178bfd","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T18:58:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8e66238e-8522-4c11-8c6a-9d3f81178bfd","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T18:58:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8e66238e-8522-4c11-8c6a-9d3f81178bfd","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T18:58:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8e66238e-8522-4c11-8c6a-9d3f81178bfd","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-b19850/sub-test-model-b19850\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T18:58:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"8e66238e-8522-4c11-8c6a-9d3f81178bfd","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-06T18:58:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8e66238e-8522-4c11-8c6a-9d3f81178bfd","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-06T18:58:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8e66238e-8522-4c11-8c6a-9d3f81178bfd","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-b-only-1d0e70"}
{"level":"debug","ts":"2026-07-06T18:58:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8e66238e-8522-4c11-8c6a-9d3f81178bfd","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-06T18:58:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8e66238e-8522-4c11-8c6a-9d3f81178bfd","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T18:58:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8e66238e-8522-4c11-8c6a-9d3f81178bfd","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T18:58:53Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"11e4c60c-a05c-406b-aa3e-99ccf7f8259b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:54842","PortSpecifier":{"PortValue":54842}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.66:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"11e4c60c-a05c-406b-aa3e-99ccf7f8259b","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-47f1eb.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T18:58:53Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"11e4c60c-a05c-406b-aa3e-99ccf7f8259b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:54842","PortSpecifier":{"PortValue":54842}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.66:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783364333,"nanos":608128610},"http":{"id":"11e4c60c-a05c-406b-aa3e-99ccf7f8259b","method":"POST","headers":{":authority":"e2e-shared-a-47f1eb.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T18:58:53Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"11e4c60c-a05c-406b-aa3e-99ccf7f8259b","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-07-06T18:58:53Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"11e4c60c-a05c-406b-aa3e-99ccf7f8259b","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-06T18:58:53Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"11e4c60c-a05c-406b-aa3e-99ccf7f8259b","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"4c117213-6436-4d5e-b6f2-0dc80354b8ad","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=b4ed87fd-f39c-46f5-8b5f-dad8294f1243"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/6aa6542dfc28"]}}
{"level":"debug","ts":"2026-07-06T18:58:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"11e4c60c-a05c-406b-aa3e-99ccf7f8259b","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/6aa6542dfc28"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=b4ed87fd-f39c-46f5-8b5f-dad8294f1243"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"4c117213-6436-4d5e-b6f2-0dc80354b8ad","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"825b4e4809451f9debccbe1150b699f739c117934b0bf98871cc2a21cd18800d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.66:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-47f1eb.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T18:58:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"11e4c60c-a05c-406b-aa3e-99ccf7f8259b","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T18:58:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"11e4c60c-a05c-406b-aa3e-99ccf7f8259b","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T18:58:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"11e4c60c-a05c-406b-aa3e-99ccf7f8259b","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-47f1eb/sub-test-model-47f1eb\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T18:58:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"11e4c60c-a05c-406b-aa3e-99ccf7f8259b","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-06T18:58:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"11e4c60c-a05c-406b-aa3e-99ccf7f8259b","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-06T18:58:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"11e4c60c-a05c-406b-aa3e-99ccf7f8259b","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-06T18:58:53Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"11e4c60c-a05c-406b-aa3e-99ccf7f8259b","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T18:58:53Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"11e4c60c-a05c-406b-aa3e-99ccf7f8259b","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T18:58:53Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"42ab0e46-921e-47cf-a59f-8bee2e0dd517","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:53684","PortSpecifier":{"PortValue":53684}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.67:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"42ab0e46-921e-47cf-a59f-8bee2e0dd517","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-b19850.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T18:58:53Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"42ab0e46-921e-47cf-a59f-8bee2e0dd517","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:53684","PortSpecifier":{"PortValue":53684}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.67:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783364333,"nanos":650973485},"http":{"id":"42ab0e46-921e-47cf-a59f-8bee2e0dd517","method":"POST","headers":{":authority":"e2e-shared-b-b19850.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T18:58:53Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"42ab0e46-921e-47cf-a59f-8bee2e0dd517","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-07-06T18:58:53Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"42ab0e46-921e-47cf-a59f-8bee2e0dd517","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-06T18:58:53Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"42ab0e46-921e-47cf-a59f-8bee2e0dd517","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"4c117213-6436-4d5e-b6f2-0dc80354b8ad","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=b4ed87fd-f39c-46f5-8b5f-dad8294f1243"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/6aa6542dfc28"]}}
{"level":"debug","ts":"2026-07-06T18:58:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"42ab0e46-921e-47cf-a59f-8bee2e0dd517","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/6aa6542dfc28"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=b4ed87fd-f39c-46f5-8b5f-dad8294f1243"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"4c117213-6436-4d5e-b6f2-0dc80354b8ad","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"cbee4de24e7f52377467bc1c31e35371aa80bf91cd74077a1bc0ff135956cb05"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.67:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-b19850.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T18:58:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"42ab0e46-921e-47cf-a59f-8bee2e0dd517","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T18:58:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"42ab0e46-921e-47cf-a59f-8bee2e0dd517","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T18:58:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"42ab0e46-921e-47cf-a59f-8bee2e0dd517","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-b19850/sub-test-model-b19850\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T18:58:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"42ab0e46-921e-47cf-a59f-8bee2e0dd517","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-06T18:58:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"42ab0e46-921e-47cf-a59f-8bee2e0dd517","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-06T18:58:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"42ab0e46-921e-47cf-a59f-8bee2e0dd517","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-06T18:58:53Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"42ab0e46-921e-47cf-a59f-8bee2e0dd517","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T18:58:53Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"42ab0e46-921e-47cf-a59f-8bee2e0dd517","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T18:58:53Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a7e9e46a-e19d-4ba7-af85-a96265ca7383","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:54858","PortSpecifier":{"PortValue":54858}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.66:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"a7e9e46a-e19d-4ba7-af85-a96265ca7383","method":"POST","path":"/maas-api/internal/v1/subscriptions/select","host":"e2e-shared-a-47f1eb.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T18:58:53Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a7e9e46a-e19d-4ba7-af85-a96265ca7383","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:54858","PortSpecifier":{"PortValue":54858}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.66:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783364333,"nanos":688272544},"http":{"id":"a7e9e46a-e19d-4ba7-af85-a96265ca7383","method":"POST","headers":{":authority":"e2e-shared-a-47f1eb.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/internal/v1/subscriptions/select",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T18:58:53Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"a7e9e46a-e19d-4ba7-af85-a96265ca7383","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1ZbczD4TmYfOiozjN_sBXeOUQAMoDEkcn8Yg5pmiI41BPYaLHYIrK6yyIcbXP"}
{"level":"debug","ts":"2026-07-06T18:58:53Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a7e9e46a-e19d-4ba7-af85-a96265ca7383","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-47f1eb.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1ZbczD4TmYfOiozjN_sBXeOUQAMoDEkcn8Yg5pmiI41BPYaLHYIrK6yyIcbXP\"}"}
{"level":"debug","ts":"2026-07-06T18:58:53Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a7e9e46a-e19d-4ba7-af85-a96265ca7383","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-47f1eb.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"078410fe-92b6-4515-85c4-5c80b3b126f6","keyName":"e2e-sub-iso-fe9f64","subscription":"e2e-shared-sub-539053","tenant":"e2e-shared-a-47f1eb","userId":"078410fe-92b6-4515-85c4-5c80b3b126f6","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-06T18:58:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"a7e9e46a-e19d-4ba7-af85-a96265ca7383","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T18:58:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a7e9e46a-e19d-4ba7-af85-a96265ca7383","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T18:58:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a7e9e46a-e19d-4ba7-af85-a96265ca7383","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T18:58:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a7e9e46a-e19d-4ba7-af85-a96265ca7383","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-47f1eb/sub-test-model-47f1eb\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T18:58:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a7e9e46a-e19d-4ba7-af85-a96265ca7383","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-06T18:58:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a7e9e46a-e19d-4ba7-af85-a96265ca7383","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-06T18:58:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a7e9e46a-e19d-4ba7-af85-a96265ca7383","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-shared-sub-539053"}
{"level":"debug","ts":"2026-07-06T18:58:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"a7e9e46a-e19d-4ba7-af85-a96265ca7383","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-06T18:58:53Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a7e9e46a-e19d-4ba7-af85-a96265ca7383","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T18:58:53Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a7e9e46a-e19d-4ba7-af85-a96265ca7383","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T18:58:53Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d50c0e39-c30a-4853-9553-f359076849e7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:53686","PortSpecifier":{"PortValue":53686}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.67:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"d50c0e39-c30a-4853-9553-f359076849e7","method":"POST","path":"/maas-api/internal/v1/subscriptions/select","host":"e2e-shared-b-b19850.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T18:58:53Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d50c0e39-c30a-4853-9553-f359076849e7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:53686","PortSpecifier":{"PortValue":53686}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.67:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783364333,"nanos":715357436},"http":{"id":"d50c0e39-c30a-4853-9553-f359076849e7","method":"POST","headers":{":authority":"e2e-shared-b-b19850.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/internal/v1/subscriptions/select",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T18:58:53Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"d50c0e39-c30a-4853-9553-f359076849e7","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1Ip3t1vp7RPJPM9BB_bet4SO4q1z0jX3qlcJZTTNsojkz392aKk1NuQBq4yLv"}
{"level":"debug","ts":"2026-07-06T18:58:53Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"d50c0e39-c30a-4853-9553-f359076849e7","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-b-b19850.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1Ip3t1vp7RPJPM9BB_bet4SO4q1z0jX3qlcJZTTNsojkz392aKk1NuQBq4yLv\"}"}
{"level":"debug","ts":"2026-07-06T18:58:53Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"d50c0e39-c30a-4853-9553-f359076849e7","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-b19850.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"d6153b8a-505d-4bbc-bbca-65af77693a6c","keyName":"e2e-sub-iso-5ad789","subscription":"e2e-shared-sub-539053","tenant":"e2e-shared-b-b19850","userId":"d6153b8a-505d-4bbc-bbca-65af77693a6c","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-06T18:58:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"d50c0e39-c30a-4853-9553-f359076849e7","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T18:58:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d50c0e39-c30a-4853-9553-f359076849e7","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T18:58:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d50c0e39-c30a-4853-9553-f359076849e7","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T18:58:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d50c0e39-c30a-4853-9553-f359076849e7","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-b19850/sub-test-model-b19850\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T18:58:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"d50c0e39-c30a-4853-9553-f359076849e7","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-06T18:58:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d50c0e39-c30a-4853-9553-f359076849e7","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-06T18:58:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d50c0e39-c30a-4853-9553-f359076849e7","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-shared-sub-539053"}
{"level":"debug","ts":"2026-07-06T18:58:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d50c0e39-c30a-4853-9553-f359076849e7","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-06T18:58:53Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d50c0e39-c30a-4853-9553-f359076849e7","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T18:58:53Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d50c0e39-c30a-4853-9553-f359076849e7","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T18:58:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/fc16a43a821191670fdc63ffb7bf3ff53176ccc44a4858cb008259a58b0f4d92"}
{"level":"info","ts":"2026-07-06T18:58:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/5a9d65c5701fb29718b4291333482e202ccca1ec287d466e5bbc52ac71e6f97d"}
{"level":"info","ts":"2026-07-06T18:58:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/f7a881610c8fda197c39df80005b3793951a6331228f22cdc9803b8d8896142a"}
{"level":"info","ts":"2026-07-06T18:58:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/b117e5e69a18e70f9e3441e4d5a07d2a919a6ee947dcdfdd1c4c066a7351c20b"}
{"level":"info","ts":"2026-07-06T18:58:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/bfc4b7e1e0637131c0eb0d94a5551362a931c0c0b49d32453ea20ba4ef4e6dca"}
{"level":"info","ts":"2026-07-06T18:58:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/c6deaf5a9aef0f5d89a83ba21d793f2672685143d1359b58c37a4c58c2879779"}
{"level":"info","ts":"2026-07-06T18:58:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/847f9857c9194bde9fa59bb12ca1c19030751765bcc282dddd8c9a1c0f3167da"}
{"level":"info","ts":"2026-07-06T18:58:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/d9b74bf4758530ace9aa0e180114d409b7624657e3560e134966578eea78671d"}
{"level":"info","ts":"2026-07-06T18:58:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/138ad913ab0cbd3091e81807e01bb3be6e433b18766bcb3c0f9fcb677e35f76b"}
{"level":"info","ts":"2026-07-06T18:58:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/07f9b7d247b651f0fb8926b5f6250b054abdd15be8c3a9d63573c4e8c0deae2f"}
{"level":"info","ts":"2026-07-06T18:58:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/4a0851213f51abc407d19ad1153df5b739fad41099b6d5979632a8f6692a7b90"}
{"level":"info","ts":"2026-07-06T18:58:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/03ac742de3b54ad0743b12586f4f86301de57c3a271b812c31477b3a870867d3"}
{"level":"info","ts":"2026-07-06T18:58:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/dea3566aff50bf52fe2d7c8f29a39148d8b5d8c43bf7893cad800ca86a951771"}
{"level":"info","ts":"2026-07-06T18:58:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/fbdc0f099c5f0482cf8bd22695623cde02d28b9fbf8f0e782579fad6bdd9083a"}
{"level":"info","ts":"2026-07-06T18:58:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/7315248866efba0d19d2f53867bdfcb3918eae4d0cbd8a4561fa8fd22da09513"}
{"level":"info","ts":"2026-07-06T18:58:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/7e68002ef8ebe7ec0f51cd08fa8fa79431fc0556ed871d55bf3217c250d120cc"}
{"level":"debug","ts":"2026-07-06T18:59:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5ec9866941ade64c99d441c372799ca42f409b0794a7903ae0c6029a45fc0056","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T18:59:23Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T18:59:23Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-06T18:59:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/5ec9866941ade64c99d441c372799ca42f409b0794a7903ae0c6029a45fc0056","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T18:59:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5ec9866941ade64c99d441c372799ca42f409b0794a7903ae0c6029a45fc0056","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:59:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5ec9866941ade64c99d441c372799ca42f409b0794a7903ae0c6029a45fc0056","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T18:59:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5ec9866941ade64c99d441c372799ca42f409b0794a7903ae0c6029a45fc0056"}
{"level":"debug","ts":"2026-07-06T18:59:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5ec9866941ade64c99d441c372799ca42f409b0794a7903ae0c6029a45fc0056","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:59:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/5ec9866941ade64c99d441c372799ca42f409b0794a7903ae0c6029a45fc0056","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-06T18:59:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5ec9866941ade64c99d441c372799ca42f409b0794a7903ae0c6029a45fc0056","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T18:59:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5ec9866941ade64c99d441c372799ca42f409b0794a7903ae0c6029a45fc0056"}
{"level":"debug","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7d66c6155f092639a8500b207fd49a41c5d4137d324a46572c9aaa18ae319b20","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T18:59:24Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T18:59:24Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/7d66c6155f092639a8500b207fd49a41c5d4137d324a46572c9aaa18ae319b20","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7d66c6155f092639a8500b207fd49a41c5d4137d324a46572c9aaa18ae319b20"}
{"level":"info","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7d66c6155f092639a8500b207fd49a41c5d4137d324a46572c9aaa18ae319b20","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5ec9866941ade64c99d441c372799ca42f409b0794a7903ae0c6029a45fc0056","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T18:59:24Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T18:59:24Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["5ec9866941ade64c99d441c372799ca42f409b0794a7903ae0c6029a45fc0056"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/7d66c6155f092639a8500b207fd49a41c5d4137d324a46572c9aaa18ae319b20","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7d66c6155f092639a8500b207fd49a41c5d4137d324a46572c9aaa18ae319b20"}
{"level":"info","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5ec9866941ade64c99d441c372799ca42f409b0794a7903ae0c6029a45fc0056","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7d66c6155f092639a8500b207fd49a41c5d4137d324a46572c9aaa18ae319b20","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T18:59:24Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T18:59:24Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["7d66c6155f092639a8500b207fd49a41c5d4137d324a46572c9aaa18ae319b20"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/5ec9866941ade64c99d441c372799ca42f409b0794a7903ae0c6029a45fc0056","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7d66c6155f092639a8500b207fd49a41c5d4137d324a46572c9aaa18ae319b20","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5ec9866941ade64c99d441c372799ca42f409b0794a7903ae0c6029a45fc0056","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T18:59:24Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T18:59:24Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5ec9866941ade64c99d441c372799ca42f409b0794a7903ae0c6029a45fc0056"}
{"level":"debug","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/7d66c6155f092639a8500b207fd49a41c5d4137d324a46572c9aaa18ae319b20","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5ec9866941ade64c99d441c372799ca42f409b0794a7903ae0c6029a45fc0056","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7d66c6155f092639a8500b207fd49a41c5d4137d324a46572c9aaa18ae319b20","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T18:59:24Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T18:59:24Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7d66c6155f092639a8500b207fd49a41c5d4137d324a46572c9aaa18ae319b20"}
{"level":"debug","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/5ec9866941ade64c99d441c372799ca42f409b0794a7903ae0c6029a45fc0056","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7d66c6155f092639a8500b207fd49a41c5d4137d324a46572c9aaa18ae319b20","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5ec9866941ade64c99d441c372799ca42f409b0794a7903ae0c6029a45fc0056","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"147688dfcb763649fb21d37d56b8c9a5eaea30776c327a0ad88421eb8647437d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T18:59:24Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T18:59:24Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"147688dfcb763649fb21d37d56b8c9a5eaea30776c327a0ad88421eb8647437d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7d66c6155f092639a8500b207fd49a41c5d4137d324a46572c9aaa18ae319b20","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T18:59:24Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T18:59:24Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["7d66c6155f092639a8500b207fd49a41c5d4137d324a46572c9aaa18ae319b20"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5ec9866941ade64c99d441c372799ca42f409b0794a7903ae0c6029a45fc0056"}
{"level":"debug","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/147688dfcb763649fb21d37d56b8c9a5eaea30776c327a0ad88421eb8647437d","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7d66c6155f092639a8500b207fd49a41c5d4137d324a46572c9aaa18ae319b20","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5ec9866941ade64c99d441c372799ca42f409b0794a7903ae0c6029a45fc0056","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T18:59:24Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T18:59:24Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["5ec9866941ade64c99d441c372799ca42f409b0794a7903ae0c6029a45fc0056"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/147688dfcb763649fb21d37d56b8c9a5eaea30776c327a0ad88421eb8647437d"}
{"level":"debug","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/7d66c6155f092639a8500b207fd49a41c5d4137d324a46572c9aaa18ae319b20","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5ec9866941ade64c99d441c372799ca42f409b0794a7903ae0c6029a45fc0056","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"147688dfcb763649fb21d37d56b8c9a5eaea30776c327a0ad88421eb8647437d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T18:59:24Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T18:59:24Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["147688dfcb763649fb21d37d56b8c9a5eaea30776c327a0ad88421eb8647437d"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7d66c6155f092639a8500b207fd49a41c5d4137d324a46572c9aaa18ae319b20"}
{"level":"debug","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/5ec9866941ade64c99d441c372799ca42f409b0794a7903ae0c6029a45fc0056","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"147688dfcb763649fb21d37d56b8c9a5eaea30776c327a0ad88421eb8647437d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7d66c6155f092639a8500b207fd49a41c5d4137d324a46572c9aaa18ae319b20","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5ec9866941ade64c99d441c372799ca42f409b0794a7903ae0c6029a45fc0056","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T18:59:24Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T18:59:24Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5ec9866941ade64c99d441c372799ca42f409b0794a7903ae0c6029a45fc0056","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"147688dfcb763649fb21d37d56b8c9a5eaea30776c327a0ad88421eb8647437d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5ec9866941ade64c99d441c372799ca42f409b0794a7903ae0c6029a45fc0056","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5ec9866941ade64c99d441c372799ca42f409b0794a7903ae0c6029a45fc0056"}
{"level":"debug","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5ec9866941ade64c99d441c372799ca42f409b0794a7903ae0c6029a45fc0056","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T18:59:24Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T18:59:24Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["5ec9866941ade64c99d441c372799ca42f409b0794a7903ae0c6029a45fc0056"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/147688dfcb763649fb21d37d56b8c9a5eaea30776c327a0ad88421eb8647437d","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5ec9866941ade64c99d441c372799ca42f409b0794a7903ae0c6029a45fc0056","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5ec9866941ade64c99d441c372799ca42f409b0794a7903ae0c6029a45fc0056","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/147688dfcb763649fb21d37d56b8c9a5eaea30776c327a0ad88421eb8647437d"}
{"level":"debug","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/5ec9866941ade64c99d441c372799ca42f409b0794a7903ae0c6029a45fc0056","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5ec9866941ade64c99d441c372799ca42f409b0794a7903ae0c6029a45fc0056"}
{"level":"debug","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e1f91f29a92736910355bd01a5ee338aa8c3cb166ff184f4e29f7f98d47ae16f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T18:59:24Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T18:59:24Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/e1f91f29a92736910355bd01a5ee338aa8c3cb166ff184f4e29f7f98d47ae16f","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e1f91f29a92736910355bd01a5ee338aa8c3cb166ff184f4e29f7f98d47ae16f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e1f91f29a92736910355bd01a5ee338aa8c3cb166ff184f4e29f7f98d47ae16f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e1f91f29a92736910355bd01a5ee338aa8c3cb166ff184f4e29f7f98d47ae16f","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e1f91f29a92736910355bd01a5ee338aa8c3cb166ff184f4e29f7f98d47ae16f"}
{"level":"debug","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/e1f91f29a92736910355bd01a5ee338aa8c3cb166ff184f4e29f7f98d47ae16f","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e1f91f29a92736910355bd01a5ee338aa8c3cb166ff184f4e29f7f98d47ae16f","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e1f91f29a92736910355bd01a5ee338aa8c3cb166ff184f4e29f7f98d47ae16f"}
{"level":"debug","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e1f91f29a92736910355bd01a5ee338aa8c3cb166ff184f4e29f7f98d47ae16f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T18:59:24Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T18:59:24Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["e1f91f29a92736910355bd01a5ee338aa8c3cb166ff184f4e29f7f98d47ae16f"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/8303d1bdcc7075b5fd8e6468df2196e7112596d35afc4edb06dccf7484f396bb","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e1f91f29a92736910355bd01a5ee338aa8c3cb166ff184f4e29f7f98d47ae16f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8303d1bdcc7075b5fd8e6468df2196e7112596d35afc4edb06dccf7484f396bb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T18:59:24Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T18:59:24Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8303d1bdcc7075b5fd8e6468df2196e7112596d35afc4edb06dccf7484f396bb"}
{"level":"info","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8303d1bdcc7075b5fd8e6468df2196e7112596d35afc4edb06dccf7484f396bb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e1f91f29a92736910355bd01a5ee338aa8c3cb166ff184f4e29f7f98d47ae16f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T18:59:24Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T18:59:24Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/e1f91f29a92736910355bd01a5ee338aa8c3cb166ff184f4e29f7f98d47ae16f","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e1f91f29a92736910355bd01a5ee338aa8c3cb166ff184f4e29f7f98d47ae16f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8303d1bdcc7075b5fd8e6468df2196e7112596d35afc4edb06dccf7484f396bb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T18:59:24Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T18:59:24Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["8303d1bdcc7075b5fd8e6468df2196e7112596d35afc4edb06dccf7484f396bb"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e1f91f29a92736910355bd01a5ee338aa8c3cb166ff184f4e29f7f98d47ae16f"}
{"level":"debug","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/8303d1bdcc7075b5fd8e6468df2196e7112596d35afc4edb06dccf7484f396bb","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8303d1bdcc7075b5fd8e6468df2196e7112596d35afc4edb06dccf7484f396bb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e1f91f29a92736910355bd01a5ee338aa8c3cb166ff184f4e29f7f98d47ae16f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T18:59:24Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T18:59:24Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["e1f91f29a92736910355bd01a5ee338aa8c3cb166ff184f4e29f7f98d47ae16f"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e1f91f29a92736910355bd01a5ee338aa8c3cb166ff184f4e29f7f98d47ae16f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8303d1bdcc7075b5fd8e6468df2196e7112596d35afc4edb06dccf7484f396bb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T18:59:24Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T18:59:24Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8303d1bdcc7075b5fd8e6468df2196e7112596d35afc4edb06dccf7484f396bb"}
{"level":"debug","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/e1f91f29a92736910355bd01a5ee338aa8c3cb166ff184f4e29f7f98d47ae16f","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8303d1bdcc7075b5fd8e6468df2196e7112596d35afc4edb06dccf7484f396bb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e1f91f29a92736910355bd01a5ee338aa8c3cb166ff184f4e29f7f98d47ae16f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T18:59:24Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T18:59:24Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e1f91f29a92736910355bd01a5ee338aa8c3cb166ff184f4e29f7f98d47ae16f"}
{"level":"debug","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/8303d1bdcc7075b5fd8e6468df2196e7112596d35afc4edb06dccf7484f396bb","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e1f91f29a92736910355bd01a5ee338aa8c3cb166ff184f4e29f7f98d47ae16f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8303d1bdcc7075b5fd8e6468df2196e7112596d35afc4edb06dccf7484f396bb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e1f91f29a92736910355bd01a5ee338aa8c3cb166ff184f4e29f7f98d47ae16f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T18:59:24Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T18:59:24Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["e1f91f29a92736910355bd01a5ee338aa8c3cb166ff184f4e29f7f98d47ae16f"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e1f91f29a92736910355bd01a5ee338aa8c3cb166ff184f4e29f7f98d47ae16f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8303d1bdcc7075b5fd8e6468df2196e7112596d35afc4edb06dccf7484f396bb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e1f91f29a92736910355bd01a5ee338aa8c3cb166ff184f4e29f7f98d47ae16f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T18:59:24Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T18:59:24Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["e1f91f29a92736910355bd01a5ee338aa8c3cb166ff184f4e29f7f98d47ae16f"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8303d1bdcc7075b5fd8e6468df2196e7112596d35afc4edb06dccf7484f396bb"}
{"level":"debug","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/e1f91f29a92736910355bd01a5ee338aa8c3cb166ff184f4e29f7f98d47ae16f","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"error","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"e1f91f29a92736910355bd01a5ee338aa8c3cb166ff184f4e29f7f98d47ae16f","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"e1f91f29a92736910355bd01a5ee338aa8c3cb166ff184f4e29f7f98d47ae16f\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e1f91f29a92736910355bd01a5ee338aa8c3cb166ff184f4e29f7f98d47ae16f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T18:59:24Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T18:59:24Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e1f91f29a92736910355bd01a5ee338aa8c3cb166ff184f4e29f7f98d47ae16f"}
{"level":"info","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e1f91f29a92736910355bd01a5ee338aa8c3cb166ff184f4e29f7f98d47ae16f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8303d1bdcc7075b5fd8e6468df2196e7112596d35afc4edb06dccf7484f396bb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T18:59:24Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T18:59:24Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["8303d1bdcc7075b5fd8e6468df2196e7112596d35afc4edb06dccf7484f396bb"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/e1f91f29a92736910355bd01a5ee338aa8c3cb166ff184f4e29f7f98d47ae16f","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8303d1bdcc7075b5fd8e6468df2196e7112596d35afc4edb06dccf7484f396bb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e1f91f29a92736910355bd01a5ee338aa8c3cb166ff184f4e29f7f98d47ae16f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8303d1bdcc7075b5fd8e6468df2196e7112596d35afc4edb06dccf7484f396bb","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e1f91f29a92736910355bd01a5ee338aa8c3cb166ff184f4e29f7f98d47ae16f"}
{"level":"debug","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/8303d1bdcc7075b5fd8e6468df2196e7112596d35afc4edb06dccf7484f396bb","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6ca4e8b470af39adaba6d354315da786e395454d9c08b0c0f160979fb65af263","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T18:59:24Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T18:59:24Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8303d1bdcc7075b5fd8e6468df2196e7112596d35afc4edb06dccf7484f396bb"}
{"level":"debug","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/e1f91f29a92736910355bd01a5ee338aa8c3cb166ff184f4e29f7f98d47ae16f","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6ca4e8b470af39adaba6d354315da786e395454d9c08b0c0f160979fb65af263","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e1f91f29a92736910355bd01a5ee338aa8c3cb166ff184f4e29f7f98d47ae16f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6ca4e8b470af39adaba6d354315da786e395454d9c08b0c0f160979fb65af263","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6ca4e8b470af39adaba6d354315da786e395454d9c08b0c0f160979fb65af263","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e1f91f29a92736910355bd01a5ee338aa8c3cb166ff184f4e29f7f98d47ae16f"}
{"level":"debug","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/6ca4e8b470af39adaba6d354315da786e395454d9c08b0c0f160979fb65af263","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6ca4e8b470af39adaba6d354315da786e395454d9c08b0c0f160979fb65af263","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T18:59:24Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T18:59:24Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6ca4e8b470af39adaba6d354315da786e395454d9c08b0c0f160979fb65af263"}
{"level":"info","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6ca4e8b470af39adaba6d354315da786e395454d9c08b0c0f160979fb65af263","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e1f91f29a92736910355bd01a5ee338aa8c3cb166ff184f4e29f7f98d47ae16f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T18:59:24Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T18:59:24Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["e1f91f29a92736910355bd01a5ee338aa8c3cb166ff184f4e29f7f98d47ae16f"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/6ca4e8b470af39adaba6d354315da786e395454d9c08b0c0f160979fb65af263","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e1f91f29a92736910355bd01a5ee338aa8c3cb166ff184f4e29f7f98d47ae16f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6ca4e8b470af39adaba6d354315da786e395454d9c08b0c0f160979fb65af263","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e1f91f29a92736910355bd01a5ee338aa8c3cb166ff184f4e29f7f98d47ae16f","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6ca4e8b470af39adaba6d354315da786e395454d9c08b0c0f160979fb65af263"}
{"level":"debug","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/e1f91f29a92736910355bd01a5ee338aa8c3cb166ff184f4e29f7f98d47ae16f","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6ca4e8b470af39adaba6d354315da786e395454d9c08b0c0f160979fb65af263","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T18:59:24Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T18:59:24Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["6ca4e8b470af39adaba6d354315da786e395454d9c08b0c0f160979fb65af263"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6ca4e8b470af39adaba6d354315da786e395454d9c08b0c0f160979fb65af263","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9ad78b9023cc5a240a2d2d4fa3cf6b0048402533ea66bf7e0f3025ea88619696","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T18:59:24Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T18:59:24Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e1f91f29a92736910355bd01a5ee338aa8c3cb166ff184f4e29f7f98d47ae16f"}
{"level":"info","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9ad78b9023cc5a240a2d2d4fa3cf6b0048402533ea66bf7e0f3025ea88619696","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8b1d89ed651da0c2fe2c43f9b6502ed2f2a48bbb88f43f119606a9d12ac3a9a9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T18:59:24Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T18:59:24Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/9ad78b9023cc5a240a2d2d4fa3cf6b0048402533ea66bf7e0f3025ea88619696","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8b1d89ed651da0c2fe2c43f9b6502ed2f2a48bbb88f43f119606a9d12ac3a9a9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6ca4e8b470af39adaba6d354315da786e395454d9c08b0c0f160979fb65af263","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9ad78b9023cc5a240a2d2d4fa3cf6b0048402533ea66bf7e0f3025ea88619696","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T18:59:24Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T18:59:24Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9ad78b9023cc5a240a2d2d4fa3cf6b0048402533ea66bf7e0f3025ea88619696","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8b1d89ed651da0c2fe2c43f9b6502ed2f2a48bbb88f43f119606a9d12ac3a9a9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9ad78b9023cc5a240a2d2d4fa3cf6b0048402533ea66bf7e0f3025ea88619696","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9ad78b9023cc5a240a2d2d4fa3cf6b0048402533ea66bf7e0f3025ea88619696"}
{"level":"debug","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/8b1d89ed651da0c2fe2c43f9b6502ed2f2a48bbb88f43f119606a9d12ac3a9a9","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9ad78b9023cc5a240a2d2d4fa3cf6b0048402533ea66bf7e0f3025ea88619696","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T18:59:24Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T18:59:24Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["9ad78b9023cc5a240a2d2d4fa3cf6b0048402533ea66bf7e0f3025ea88619696"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9ad78b9023cc5a240a2d2d4fa3cf6b0048402533ea66bf7e0f3025ea88619696","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8b1d89ed651da0c2fe2c43f9b6502ed2f2a48bbb88f43f119606a9d12ac3a9a9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T18:59:24Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T18:59:24Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8b1d89ed651da0c2fe2c43f9b6502ed2f2a48bbb88f43f119606a9d12ac3a9a9"}
{"level":"debug","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/6ca4e8b470af39adaba6d354315da786e395454d9c08b0c0f160979fb65af263","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8b1d89ed651da0c2fe2c43f9b6502ed2f2a48bbb88f43f119606a9d12ac3a9a9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9ad78b9023cc5a240a2d2d4fa3cf6b0048402533ea66bf7e0f3025ea88619696","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8b1d89ed651da0c2fe2c43f9b6502ed2f2a48bbb88f43f119606a9d12ac3a9a9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T18:59:24Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T18:59:24Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["8b1d89ed651da0c2fe2c43f9b6502ed2f2a48bbb88f43f119606a9d12ac3a9a9"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6ca4e8b470af39adaba6d354315da786e395454d9c08b0c0f160979fb65af263"}
{"level":"debug","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/9ad78b9023cc5a240a2d2d4fa3cf6b0048402533ea66bf7e0f3025ea88619696","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8b1d89ed651da0c2fe2c43f9b6502ed2f2a48bbb88f43f119606a9d12ac3a9a9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8b1d89ed651da0c2fe2c43f9b6502ed2f2a48bbb88f43f119606a9d12ac3a9a9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T18:59:24Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T18:59:24Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["8b1d89ed651da0c2fe2c43f9b6502ed2f2a48bbb88f43f119606a9d12ac3a9a9"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"error","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"8b1d89ed651da0c2fe2c43f9b6502ed2f2a48bbb88f43f119606a9d12ac3a9a9","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"8b1d89ed651da0c2fe2c43f9b6502ed2f2a48bbb88f43f119606a9d12ac3a9a9\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8b1d89ed651da0c2fe2c43f9b6502ed2f2a48bbb88f43f119606a9d12ac3a9a9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8b1d89ed651da0c2fe2c43f9b6502ed2f2a48bbb88f43f119606a9d12ac3a9a9","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9ad78b9023cc5a240a2d2d4fa3cf6b0048402533ea66bf7e0f3025ea88619696"}
{"level":"debug","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/8b1d89ed651da0c2fe2c43f9b6502ed2f2a48bbb88f43f119606a9d12ac3a9a9","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T18:59:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8b1d89ed651da0c2fe2c43f9b6502ed2f2a48bbb88f43f119606a9d12ac3a9a9"}
{"level":"debug","ts":"2026-07-06T19:00:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5cbb644a58fc4f41c2dc3c9132b9d5a444d13468498b369f90ef7710141fd409","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T19:00:02Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T19:00:02Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-06T19:00:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/5cbb644a58fc4f41c2dc3c9132b9d5a444d13468498b369f90ef7710141fd409","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T19:00:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5cbb644a58fc4f41c2dc3c9132b9d5a444d13468498b369f90ef7710141fd409","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:00:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5cbb644a58fc4f41c2dc3c9132b9d5a444d13468498b369f90ef7710141fd409","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T19:00:02Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T19:00:02Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T19:00:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5cbb644a58fc4f41c2dc3c9132b9d5a444d13468498b369f90ef7710141fd409"}
{"level":"info","ts":"2026-07-06T19:00:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5cbb644a58fc4f41c2dc3c9132b9d5a444d13468498b369f90ef7710141fd409","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:00:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5cbb644a58fc4f41c2dc3c9132b9d5a444d13468498b369f90ef7710141fd409","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T19:00:02Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T19:00:02Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-06T19:00:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/5cbb644a58fc4f41c2dc3c9132b9d5a444d13468498b369f90ef7710141fd409","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"error","ts":"2026-07-06T19:00:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"5cbb644a58fc4f41c2dc3c9132b9d5a444d13468498b369f90ef7710141fd409","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"5cbb644a58fc4f41c2dc3c9132b9d5a444d13468498b369f90ef7710141fd409\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-06T19:00:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5cbb644a58fc4f41c2dc3c9132b9d5a444d13468498b369f90ef7710141fd409","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:00:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5cbb644a58fc4f41c2dc3c9132b9d5a444d13468498b369f90ef7710141fd409","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T19:00:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5cbb644a58fc4f41c2dc3c9132b9d5a444d13468498b369f90ef7710141fd409"}
{"level":"debug","ts":"2026-07-06T19:00:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/5cbb644a58fc4f41c2dc3c9132b9d5a444d13468498b369f90ef7710141fd409","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-06T19:00:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3a0f9c9dc56e9c56e4cc3a1a02dafc2c892dee0417dca18ab5b923374d7a6b1d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T19:00:02Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T19:00:02Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T19:00:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5cbb644a58fc4f41c2dc3c9132b9d5a444d13468498b369f90ef7710141fd409"}
{"level":"debug","ts":"2026-07-06T19:00:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/3a0f9c9dc56e9c56e4cc3a1a02dafc2c892dee0417dca18ab5b923374d7a6b1d","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T19:00:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3a0f9c9dc56e9c56e4cc3a1a02dafc2c892dee0417dca18ab5b923374d7a6b1d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:00:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3a0f9c9dc56e9c56e4cc3a1a02dafc2c892dee0417dca18ab5b923374d7a6b1d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T19:00:02Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T19:00:02Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T19:00:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3a0f9c9dc56e9c56e4cc3a1a02dafc2c892dee0417dca18ab5b923374d7a6b1d"}
{"level":"info","ts":"2026-07-06T19:00:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3a0f9c9dc56e9c56e4cc3a1a02dafc2c892dee0417dca18ab5b923374d7a6b1d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:00:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3a0f9c9dc56e9c56e4cc3a1a02dafc2c892dee0417dca18ab5b923374d7a6b1d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T19:00:02Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T19:00:02Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-06T19:00:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/3a0f9c9dc56e9c56e4cc3a1a02dafc2c892dee0417dca18ab5b923374d7a6b1d","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"error","ts":"2026-07-06T19:00:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"3a0f9c9dc56e9c56e4cc3a1a02dafc2c892dee0417dca18ab5b923374d7a6b1d","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"3a0f9c9dc56e9c56e4cc3a1a02dafc2c892dee0417dca18ab5b923374d7a6b1d\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-06T19:00:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5cbb644a58fc4f41c2dc3c9132b9d5a444d13468498b369f90ef7710141fd409","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T19:00:02Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T19:00:02Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["5cbb644a58fc4f41c2dc3c9132b9d5a444d13468498b369f90ef7710141fd409"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T19:00:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3a0f9c9dc56e9c56e4cc3a1a02dafc2c892dee0417dca18ab5b923374d7a6b1d"}
{"level":"debug","ts":"2026-07-06T19:00:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/3a0f9c9dc56e9c56e4cc3a1a02dafc2c892dee0417dca18ab5b923374d7a6b1d","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T19:00:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5cbb644a58fc4f41c2dc3c9132b9d5a444d13468498b369f90ef7710141fd409","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:00:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3a0f9c9dc56e9c56e4cc3a1a02dafc2c892dee0417dca18ab5b923374d7a6b1d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:00:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5cbb644a58fc4f41c2dc3c9132b9d5a444d13468498b369f90ef7710141fd409","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:00:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3a0f9c9dc56e9c56e4cc3a1a02dafc2c892dee0417dca18ab5b923374d7a6b1d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T19:00:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3a0f9c9dc56e9c56e4cc3a1a02dafc2c892dee0417dca18ab5b923374d7a6b1d"}
{"level":"debug","ts":"2026-07-06T19:00:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/5cbb644a58fc4f41c2dc3c9132b9d5a444d13468498b369f90ef7710141fd409","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-06T19:00:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7502b45ed071984dbeda4aed13e858926b7ad79e7003a8ec77863722ce02bd5e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T19:00:02Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T19:00:02Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T19:00:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5cbb644a58fc4f41c2dc3c9132b9d5a444d13468498b369f90ef7710141fd409"}
{"level":"debug","ts":"2026-07-06T19:00:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/7502b45ed071984dbeda4aed13e858926b7ad79e7003a8ec77863722ce02bd5e","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T19:00:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7502b45ed071984dbeda4aed13e858926b7ad79e7003a8ec77863722ce02bd5e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:00:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7502b45ed071984dbeda4aed13e858926b7ad79e7003a8ec77863722ce02bd5e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T19:00:02Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T19:00:02Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T19:00:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7502b45ed071984dbeda4aed13e858926b7ad79e7003a8ec77863722ce02bd5e"}
{"level":"debug","ts":"2026-07-06T19:00:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/7502b45ed071984dbeda4aed13e858926b7ad79e7003a8ec77863722ce02bd5e","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T19:00:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7502b45ed071984dbeda4aed13e858926b7ad79e7003a8ec77863722ce02bd5e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:00:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7502b45ed071984dbeda4aed13e858926b7ad79e7003a8ec77863722ce02bd5e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T19:00:02Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T19:00:02Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"error","ts":"2026-07-06T19:00:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"7502b45ed071984dbeda4aed13e858926b7ad79e7003a8ec77863722ce02bd5e","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"7502b45ed071984dbeda4aed13e858926b7ad79e7003a8ec77863722ce02bd5e\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-06T19:00:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3a0f9c9dc56e9c56e4cc3a1a02dafc2c892dee0417dca18ab5b923374d7a6b1d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T19:00:02Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T19:00:02Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3a0f9c9dc56e9c56e4cc3a1a02dafc2c892dee0417dca18ab5b923374d7a6b1d"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T19:00:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7502b45ed071984dbeda4aed13e858926b7ad79e7003a8ec77863722ce02bd5e"}
{"level":"debug","ts":"2026-07-06T19:00:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/7502b45ed071984dbeda4aed13e858926b7ad79e7003a8ec77863722ce02bd5e","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T19:00:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3a0f9c9dc56e9c56e4cc3a1a02dafc2c892dee0417dca18ab5b923374d7a6b1d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:00:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7502b45ed071984dbeda4aed13e858926b7ad79e7003a8ec77863722ce02bd5e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:00:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3a0f9c9dc56e9c56e4cc3a1a02dafc2c892dee0417dca18ab5b923374d7a6b1d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:00:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7502b45ed071984dbeda4aed13e858926b7ad79e7003a8ec77863722ce02bd5e","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T19:00:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7502b45ed071984dbeda4aed13e858926b7ad79e7003a8ec77863722ce02bd5e"}
{"level":"debug","ts":"2026-07-06T19:00:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/3a0f9c9dc56e9c56e4cc3a1a02dafc2c892dee0417dca18ab5b923374d7a6b1d","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-06T19:00:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"87a150eabc7659da2832b5d5f95adaf4b9a45a76bf4b3b01eb3be5b331c1f349","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T19:00:02Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T19:00:02Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T19:00:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3a0f9c9dc56e9c56e4cc3a1a02dafc2c892dee0417dca18ab5b923374d7a6b1d"}
{"level":"info","ts":"2026-07-06T19:00:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"87a150eabc7659da2832b5d5f95adaf4b9a45a76bf4b3b01eb3be5b331c1f349","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:00:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/87a150eabc7659da2832b5d5f95adaf4b9a45a76bf4b3b01eb3be5b331c1f349","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-06T19:00:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"87a150eabc7659da2832b5d5f95adaf4b9a45a76bf4b3b01eb3be5b331c1f349","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T19:00:02Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T19:00:02Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T19:00:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/87a150eabc7659da2832b5d5f95adaf4b9a45a76bf4b3b01eb3be5b331c1f349"}
{"level":"info","ts":"2026-07-06T19:00:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"87a150eabc7659da2832b5d5f95adaf4b9a45a76bf4b3b01eb3be5b331c1f349","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:00:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"87a150eabc7659da2832b5d5f95adaf4b9a45a76bf4b3b01eb3be5b331c1f349","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T19:00:02Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T19:00:02Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-06T19:00:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/87a150eabc7659da2832b5d5f95adaf4b9a45a76bf4b3b01eb3be5b331c1f349","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"error","ts":"2026-07-06T19:00:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"87a150eabc7659da2832b5d5f95adaf4b9a45a76bf4b3b01eb3be5b331c1f349","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"87a150eabc7659da2832b5d5f95adaf4b9a45a76bf4b3b01eb3be5b331c1f349\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-06T19:00:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"87a150eabc7659da2832b5d5f95adaf4b9a45a76bf4b3b01eb3be5b331c1f349","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:00:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"87a150eabc7659da2832b5d5f95adaf4b9a45a76bf4b3b01eb3be5b331c1f349","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:00:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7502b45ed071984dbeda4aed13e858926b7ad79e7003a8ec77863722ce02bd5e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T19:00:02Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T19:00:02Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["7502b45ed071984dbeda4aed13e858926b7ad79e7003a8ec77863722ce02bd5e"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T19:00:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/87a150eabc7659da2832b5d5f95adaf4b9a45a76bf4b3b01eb3be5b331c1f349"}
{"level":"debug","ts":"2026-07-06T19:00:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/87a150eabc7659da2832b5d5f95adaf4b9a45a76bf4b3b01eb3be5b331c1f349","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T19:00:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7502b45ed071984dbeda4aed13e858926b7ad79e7003a8ec77863722ce02bd5e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:00:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7502b45ed071984dbeda4aed13e858926b7ad79e7003a8ec77863722ce02bd5e","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T19:00:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/87a150eabc7659da2832b5d5f95adaf4b9a45a76bf4b3b01eb3be5b331c1f349"}
{"level":"debug","ts":"2026-07-06T19:00:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/7502b45ed071984dbeda4aed13e858926b7ad79e7003a8ec77863722ce02bd5e","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-06T19:00:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a8db3e05c0ce7a595b7845bfe4f4219f6fabcea2e7f26f378c3989d3017c5b8d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T19:00:02Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T19:00:02Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T19:00:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7502b45ed071984dbeda4aed13e858926b7ad79e7003a8ec77863722ce02bd5e"}
{"level":"info","ts":"2026-07-06T19:00:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a8db3e05c0ce7a595b7845bfe4f4219f6fabcea2e7f26f378c3989d3017c5b8d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:00:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/a8db3e05c0ce7a595b7845bfe4f4219f6fabcea2e7f26f378c3989d3017c5b8d","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-06T19:00:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a8db3e05c0ce7a595b7845bfe4f4219f6fabcea2e7f26f378c3989d3017c5b8d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T19:00:02Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T19:00:02Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T19:00:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a8db3e05c0ce7a595b7845bfe4f4219f6fabcea2e7f26f378c3989d3017c5b8d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:00:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"87a150eabc7659da2832b5d5f95adaf4b9a45a76bf4b3b01eb3be5b331c1f349","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T19:00:02Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T19:00:02Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["87a150eabc7659da2832b5d5f95adaf4b9a45a76bf4b3b01eb3be5b331c1f349"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T19:00:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a8db3e05c0ce7a595b7845bfe4f4219f6fabcea2e7f26f378c3989d3017c5b8d"}
{"level":"debug","ts":"2026-07-06T19:00:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/a8db3e05c0ce7a595b7845bfe4f4219f6fabcea2e7f26f378c3989d3017c5b8d","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T19:00:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"87a150eabc7659da2832b5d5f95adaf4b9a45a76bf4b3b01eb3be5b331c1f349","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:00:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a8db3e05c0ce7a595b7845bfe4f4219f6fabcea2e7f26f378c3989d3017c5b8d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:00:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"87a150eabc7659da2832b5d5f95adaf4b9a45a76bf4b3b01eb3be5b331c1f349","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T19:00:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a8db3e05c0ce7a595b7845bfe4f4219f6fabcea2e7f26f378c3989d3017c5b8d"}
{"level":"debug","ts":"2026-07-06T19:00:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/87a150eabc7659da2832b5d5f95adaf4b9a45a76bf4b3b01eb3be5b331c1f349","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-06T19:00:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a8db3e05c0ce7a595b7845bfe4f4219f6fabcea2e7f26f378c3989d3017c5b8d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T19:00:02Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T19:00:02Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a8db3e05c0ce7a595b7845bfe4f4219f6fabcea2e7f26f378c3989d3017c5b8d"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T19:00:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a8db3e05c0ce7a595b7845bfe4f4219f6fabcea2e7f26f378c3989d3017c5b8d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:00:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a8db3e05c0ce7a595b7845bfe4f4219f6fabcea2e7f26f378c3989d3017c5b8d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T19:00:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/87a150eabc7659da2832b5d5f95adaf4b9a45a76bf4b3b01eb3be5b331c1f349"}
{"level":"debug","ts":"2026-07-06T19:00:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/a8db3e05c0ce7a595b7845bfe4f4219f6fabcea2e7f26f378c3989d3017c5b8d","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-06T19:00:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"58bf29a02801972c7f59b1466d5bbc3c0ed035c240cdaea6a916bc01bbcd6f48","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T19:00:02Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T19:00:02Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T19:00:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a8db3e05c0ce7a595b7845bfe4f4219f6fabcea2e7f26f378c3989d3017c5b8d"}
{"level":"debug","ts":"2026-07-06T19:00:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/58bf29a02801972c7f59b1466d5bbc3c0ed035c240cdaea6a916bc01bbcd6f48","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T19:00:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"58bf29a02801972c7f59b1466d5bbc3c0ed035c240cdaea6a916bc01bbcd6f48","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:00:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"58bf29a02801972c7f59b1466d5bbc3c0ed035c240cdaea6a916bc01bbcd6f48","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T19:00:02Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T19:00:02Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T19:00:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/58bf29a02801972c7f59b1466d5bbc3c0ed035c240cdaea6a916bc01bbcd6f48"}
{"level":"info","ts":"2026-07-06T19:00:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"58bf29a02801972c7f59b1466d5bbc3c0ed035c240cdaea6a916bc01bbcd6f48","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:00:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"58bf29a02801972c7f59b1466d5bbc3c0ed035c240cdaea6a916bc01bbcd6f48","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T19:00:02Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T19:00:02Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-06T19:00:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/58bf29a02801972c7f59b1466d5bbc3c0ed035c240cdaea6a916bc01bbcd6f48","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"error","ts":"2026-07-06T19:00:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"58bf29a02801972c7f59b1466d5bbc3c0ed035c240cdaea6a916bc01bbcd6f48","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"58bf29a02801972c7f59b1466d5bbc3c0ed035c240cdaea6a916bc01bbcd6f48\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-06T19:00:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"58bf29a02801972c7f59b1466d5bbc3c0ed035c240cdaea6a916bc01bbcd6f48","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:00:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"58bf29a02801972c7f59b1466d5bbc3c0ed035c240cdaea6a916bc01bbcd6f48","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T19:00:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/58bf29a02801972c7f59b1466d5bbc3c0ed035c240cdaea6a916bc01bbcd6f48"}
{"level":"debug","ts":"2026-07-06T19:00:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/58bf29a02801972c7f59b1466d5bbc3c0ed035c240cdaea6a916bc01bbcd6f48","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T19:00:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/58bf29a02801972c7f59b1466d5bbc3c0ed035c240cdaea6a916bc01bbcd6f48"}
{"level":"debug","ts":"2026-07-06T19:00:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8dd963d9fdee69e495f1d79fa7b59322ec1d8328bba623f2ca62c54bb829402e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T19:00:03Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T19:00:03Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-06T19:00:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/8dd963d9fdee69e495f1d79fa7b59322ec1d8328bba623f2ca62c54bb829402e","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T19:00:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8dd963d9fdee69e495f1d79fa7b59322ec1d8328bba623f2ca62c54bb829402e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:00:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8dd963d9fdee69e495f1d79fa7b59322ec1d8328bba623f2ca62c54bb829402e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:00:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8dd963d9fdee69e495f1d79fa7b59322ec1d8328bba623f2ca62c54bb829402e","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T19:00:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8dd963d9fdee69e495f1d79fa7b59322ec1d8328bba623f2ca62c54bb829402e"}
{"level":"debug","ts":"2026-07-06T19:00:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/8dd963d9fdee69e495f1d79fa7b59322ec1d8328bba623f2ca62c54bb829402e","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-06T19:00:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"58bf29a02801972c7f59b1466d5bbc3c0ed035c240cdaea6a916bc01bbcd6f48","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T19:00:03Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T19:00:03Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["58bf29a02801972c7f59b1466d5bbc3c0ed035c240cdaea6a916bc01bbcd6f48"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T19:00:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8dd963d9fdee69e495f1d79fa7b59322ec1d8328bba623f2ca62c54bb829402e"}
{"level":"info","ts":"2026-07-06T19:00:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"58bf29a02801972c7f59b1466d5bbc3c0ed035c240cdaea6a916bc01bbcd6f48","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:00:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8dd963d9fdee69e495f1d79fa7b59322ec1d8328bba623f2ca62c54bb829402e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T19:00:03Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T19:00:03Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["8dd963d9fdee69e495f1d79fa7b59322ec1d8328bba623f2ca62c54bb829402e"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-06T19:00:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/58bf29a02801972c7f59b1466d5bbc3c0ed035c240cdaea6a916bc01bbcd6f48","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T19:00:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8dd963d9fdee69e495f1d79fa7b59322ec1d8328bba623f2ca62c54bb829402e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:00:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"58bf29a02801972c7f59b1466d5bbc3c0ed035c240cdaea6a916bc01bbcd6f48","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T19:00:03Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T19:00:03Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T19:00:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/58bf29a02801972c7f59b1466d5bbc3c0ed035c240cdaea6a916bc01bbcd6f48"}
{"level":"debug","ts":"2026-07-06T19:00:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/8dd963d9fdee69e495f1d79fa7b59322ec1d8328bba623f2ca62c54bb829402e","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T19:00:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"58bf29a02801972c7f59b1466d5bbc3c0ed035c240cdaea6a916bc01bbcd6f48","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:00:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8dd963d9fdee69e495f1d79fa7b59322ec1d8328bba623f2ca62c54bb829402e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T19:00:03Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T19:00:03Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T19:00:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8dd963d9fdee69e495f1d79fa7b59322ec1d8328bba623f2ca62c54bb829402e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:00:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"58bf29a02801972c7f59b1466d5bbc3c0ed035c240cdaea6a916bc01bbcd6f48","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T19:00:03Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T19:00:03Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["58bf29a02801972c7f59b1466d5bbc3c0ed035c240cdaea6a916bc01bbcd6f48"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T19:00:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8dd963d9fdee69e495f1d79fa7b59322ec1d8328bba623f2ca62c54bb829402e"}
{"level":"debug","ts":"2026-07-06T19:00:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/58bf29a02801972c7f59b1466d5bbc3c0ed035c240cdaea6a916bc01bbcd6f48","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T19:00:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"58bf29a02801972c7f59b1466d5bbc3c0ed035c240cdaea6a916bc01bbcd6f48","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:00:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f050fbdb2027a47041339e2497a427bf2a259f8bb025b2ff3c5540fa5031ce18","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T19:00:03Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T19:00:03Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T19:00:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/58bf29a02801972c7f59b1466d5bbc3c0ed035c240cdaea6a916bc01bbcd6f48"}
{"level":"debug","ts":"2026-07-06T19:00:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/f050fbdb2027a47041339e2497a427bf2a259f8bb025b2ff3c5540fa5031ce18","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T19:00:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f050fbdb2027a47041339e2497a427bf2a259f8bb025b2ff3c5540fa5031ce18","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:00:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8dd963d9fdee69e495f1d79fa7b59322ec1d8328bba623f2ca62c54bb829402e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T19:00:03Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T19:00:03Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["8dd963d9fdee69e495f1d79fa7b59322ec1d8328bba623f2ca62c54bb829402e"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T19:00:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f050fbdb2027a47041339e2497a427bf2a259f8bb025b2ff3c5540fa5031ce18"}
{"level":"debug","ts":"2026-07-06T19:00:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/8dd963d9fdee69e495f1d79fa7b59322ec1d8328bba623f2ca62c54bb829402e","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T19:00:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8dd963d9fdee69e495f1d79fa7b59322ec1d8328bba623f2ca62c54bb829402e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:00:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"58bf29a02801972c7f59b1466d5bbc3c0ed035c240cdaea6a916bc01bbcd6f48","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:00:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f050fbdb2027a47041339e2497a427bf2a259f8bb025b2ff3c5540fa5031ce18","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T19:00:03Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T19:00:03Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["f050fbdb2027a47041339e2497a427bf2a259f8bb025b2ff3c5540fa5031ce18"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T19:00:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8dd963d9fdee69e495f1d79fa7b59322ec1d8328bba623f2ca62c54bb829402e"}
{"level":"info","ts":"2026-07-06T19:00:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f050fbdb2027a47041339e2497a427bf2a259f8bb025b2ff3c5540fa5031ce18","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:00:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8dd963d9fdee69e495f1d79fa7b59322ec1d8328bba623f2ca62c54bb829402e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:00:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f050fbdb2027a47041339e2497a427bf2a259f8bb025b2ff3c5540fa5031ce18","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:00:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/58bf29a02801972c7f59b1466d5bbc3c0ed035c240cdaea6a916bc01bbcd6f48","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T19:00:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/58bf29a02801972c7f59b1466d5bbc3c0ed035c240cdaea6a916bc01bbcd6f48"}
{"level":"debug","ts":"2026-07-06T19:00:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/f050fbdb2027a47041339e2497a427bf2a259f8bb025b2ff3c5540fa5031ce18","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T19:00:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f050fbdb2027a47041339e2497a427bf2a259f8bb025b2ff3c5540fa5031ce18"}
{"level":"debug","ts":"2026-07-06T19:00:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/8dd963d9fdee69e495f1d79fa7b59322ec1d8328bba623f2ca62c54bb829402e","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T19:00:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8dd963d9fdee69e495f1d79fa7b59322ec1d8328bba623f2ca62c54bb829402e"}
{"level":"debug","ts":"2026-07-06T19:00:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"eb2791bd549e8278812cf508beb14dde3010dd6c48eb99afe00a94c55d9ae82a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T19:00:16Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T19:00:16Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-06T19:00:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/eb2791bd549e8278812cf508beb14dde3010dd6c48eb99afe00a94c55d9ae82a","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T19:00:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"eb2791bd549e8278812cf508beb14dde3010dd6c48eb99afe00a94c55d9ae82a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:00:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"eb2791bd549e8278812cf508beb14dde3010dd6c48eb99afe00a94c55d9ae82a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:00:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"eb2791bd549e8278812cf508beb14dde3010dd6c48eb99afe00a94c55d9ae82a","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T19:00:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/eb2791bd549e8278812cf508beb14dde3010dd6c48eb99afe00a94c55d9ae82a"}
{"level":"debug","ts":"2026-07-06T19:00:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/eb2791bd549e8278812cf508beb14dde3010dd6c48eb99afe00a94c55d9ae82a","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-06T19:00:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"eb2791bd549e8278812cf508beb14dde3010dd6c48eb99afe00a94c55d9ae82a","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T19:00:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/eb2791bd549e8278812cf508beb14dde3010dd6c48eb99afe00a94c55d9ae82a"}
{"level":"debug","ts":"2026-07-06T19:00:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"eb2791bd549e8278812cf508beb14dde3010dd6c48eb99afe00a94c55d9ae82a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T19:00:16Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T19:00:16Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["eb2791bd549e8278812cf508beb14dde3010dd6c48eb99afe00a94c55d9ae82a"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-06T19:00:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/147688dfcb763649fb21d37d56b8c9a5eaea30776c327a0ad88421eb8647437d","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T19:00:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/147688dfcb763649fb21d37d56b8c9a5eaea30776c327a0ad88421eb8647437d"}
{"level":"info","ts":"2026-07-06T19:00:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"eb2791bd549e8278812cf508beb14dde3010dd6c48eb99afe00a94c55d9ae82a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:00:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"147688dfcb763649fb21d37d56b8c9a5eaea30776c327a0ad88421eb8647437d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:00:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"eb2791bd549e8278812cf508beb14dde3010dd6c48eb99afe00a94c55d9ae82a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T19:00:16Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T19:00:16Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-06T19:00:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/eb2791bd549e8278812cf508beb14dde3010dd6c48eb99afe00a94c55d9ae82a","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T19:00:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"eb2791bd549e8278812cf508beb14dde3010dd6c48eb99afe00a94c55d9ae82a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:00:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"eb2791bd549e8278812cf508beb14dde3010dd6c48eb99afe00a94c55d9ae82a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:00:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"eb2791bd549e8278812cf508beb14dde3010dd6c48eb99afe00a94c55d9ae82a","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T19:00:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/eb2791bd549e8278812cf508beb14dde3010dd6c48eb99afe00a94c55d9ae82a"}
{"level":"debug","ts":"2026-07-06T19:00:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/eb2791bd549e8278812cf508beb14dde3010dd6c48eb99afe00a94c55d9ae82a","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-06T19:00:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"eb2791bd549e8278812cf508beb14dde3010dd6c48eb99afe00a94c55d9ae82a","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T19:00:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/eb2791bd549e8278812cf508beb14dde3010dd6c48eb99afe00a94c55d9ae82a"}
{"level":"debug","ts":"2026-07-06T19:00:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"58bf29a02801972c7f59b1466d5bbc3c0ed035c240cdaea6a916bc01bbcd6f48","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T19:00:16Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T19:00:16Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-06T19:00:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/58bf29a02801972c7f59b1466d5bbc3c0ed035c240cdaea6a916bc01bbcd6f48","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T19:00:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"58bf29a02801972c7f59b1466d5bbc3c0ed035c240cdaea6a916bc01bbcd6f48","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:00:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"eb2791bd549e8278812cf508beb14dde3010dd6c48eb99afe00a94c55d9ae82a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T19:00:16Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T19:00:16Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["eb2791bd549e8278812cf508beb14dde3010dd6c48eb99afe00a94c55d9ae82a"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T19:00:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/58bf29a02801972c7f59b1466d5bbc3c0ed035c240cdaea6a916bc01bbcd6f48"}
{"level":"debug","ts":"2026-07-06T19:00:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/e1f91f29a92736910355bd01a5ee338aa8c3cb166ff184f4e29f7f98d47ae16f","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T19:00:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"eb2791bd549e8278812cf508beb14dde3010dd6c48eb99afe00a94c55d9ae82a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:00:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"58bf29a02801972c7f59b1466d5bbc3c0ed035c240cdaea6a916bc01bbcd6f48","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T19:00:16Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T19:00:16Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["58bf29a02801972c7f59b1466d5bbc3c0ed035c240cdaea6a916bc01bbcd6f48"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T19:00:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"58bf29a02801972c7f59b1466d5bbc3c0ed035c240cdaea6a916bc01bbcd6f48","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:00:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e1f91f29a92736910355bd01a5ee338aa8c3cb166ff184f4e29f7f98d47ae16f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T19:00:16Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T19:00:16Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T19:00:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e1f91f29a92736910355bd01a5ee338aa8c3cb166ff184f4e29f7f98d47ae16f"}
{"level":"debug","ts":"2026-07-06T19:00:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/58bf29a02801972c7f59b1466d5bbc3c0ed035c240cdaea6a916bc01bbcd6f48","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T19:00:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e1f91f29a92736910355bd01a5ee338aa8c3cb166ff184f4e29f7f98d47ae16f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:00:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"eb2791bd549e8278812cf508beb14dde3010dd6c48eb99afe00a94c55d9ae82a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:00:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"58bf29a02801972c7f59b1466d5bbc3c0ed035c240cdaea6a916bc01bbcd6f48","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T19:00:16Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T19:00:16Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T19:00:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/58bf29a02801972c7f59b1466d5bbc3c0ed035c240cdaea6a916bc01bbcd6f48"}
{"level":"debug","ts":"2026-07-06T19:00:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/eb2791bd549e8278812cf508beb14dde3010dd6c48eb99afe00a94c55d9ae82a","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T19:00:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"58bf29a02801972c7f59b1466d5bbc3c0ed035c240cdaea6a916bc01bbcd6f48","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:00:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e1f91f29a92736910355bd01a5ee338aa8c3cb166ff184f4e29f7f98d47ae16f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T19:00:16Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T19:00:16Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["e1f91f29a92736910355bd01a5ee338aa8c3cb166ff184f4e29f7f98d47ae16f"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T19:00:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/eb2791bd549e8278812cf508beb14dde3010dd6c48eb99afe00a94c55d9ae82a"}
{"level":"debug","ts":"2026-07-06T19:00:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/e1f91f29a92736910355bd01a5ee338aa8c3cb166ff184f4e29f7f98d47ae16f","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T19:00:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e1f91f29a92736910355bd01a5ee338aa8c3cb166ff184f4e29f7f98d47ae16f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:00:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"58bf29a02801972c7f59b1466d5bbc3c0ed035c240cdaea6a916bc01bbcd6f48","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T19:00:16Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T19:00:16Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["58bf29a02801972c7f59b1466d5bbc3c0ed035c240cdaea6a916bc01bbcd6f48"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T19:00:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"58bf29a02801972c7f59b1466d5bbc3c0ed035c240cdaea6a916bc01bbcd6f48","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:00:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"86345123ead4f37c7ec089e50cf7cc6cbfc5de47b541dbabfaa88510bcb6732b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:00:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e1f91f29a92736910355bd01a5ee338aa8c3cb166ff184f4e29f7f98d47ae16f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T19:00:16Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T19:00:16Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T19:00:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e1f91f29a92736910355bd01a5ee338aa8c3cb166ff184f4e29f7f98d47ae16f"}
{"level":"debug","ts":"2026-07-06T19:00:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/58bf29a02801972c7f59b1466d5bbc3c0ed035c240cdaea6a916bc01bbcd6f48","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T19:00:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e1f91f29a92736910355bd01a5ee338aa8c3cb166ff184f4e29f7f98d47ae16f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:00:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"58bf29a02801972c7f59b1466d5bbc3c0ed035c240cdaea6a916bc01bbcd6f48","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T19:00:16Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T19:00:16Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T19:00:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/58bf29a02801972c7f59b1466d5bbc3c0ed035c240cdaea6a916bc01bbcd6f48"}
{"level":"debug","ts":"2026-07-06T19:00:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/86345123ead4f37c7ec089e50cf7cc6cbfc5de47b541dbabfaa88510bcb6732b","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T19:00:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"58bf29a02801972c7f59b1466d5bbc3c0ed035c240cdaea6a916bc01bbcd6f48","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:00:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e1f91f29a92736910355bd01a5ee338aa8c3cb166ff184f4e29f7f98d47ae16f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T19:00:16Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T19:00:16Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["e1f91f29a92736910355bd01a5ee338aa8c3cb166ff184f4e29f7f98d47ae16f"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T19:00:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/86345123ead4f37c7ec089e50cf7cc6cbfc5de47b541dbabfaa88510bcb6732b"}
{"level":"info","ts":"2026-07-06T19:00:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e1f91f29a92736910355bd01a5ee338aa8c3cb166ff184f4e29f7f98d47ae16f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:00:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/e1f91f29a92736910355bd01a5ee338aa8c3cb166ff184f4e29f7f98d47ae16f","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-06T19:00:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"58bf29a02801972c7f59b1466d5bbc3c0ed035c240cdaea6a916bc01bbcd6f48","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T19:00:16Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T19:00:16Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["58bf29a02801972c7f59b1466d5bbc3c0ed035c240cdaea6a916bc01bbcd6f48"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T19:00:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"58bf29a02801972c7f59b1466d5bbc3c0ed035c240cdaea6a916bc01bbcd6f48","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:00:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e1f91f29a92736910355bd01a5ee338aa8c3cb166ff184f4e29f7f98d47ae16f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T19:00:16Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T19:00:16Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T19:00:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e1f91f29a92736910355bd01a5ee338aa8c3cb166ff184f4e29f7f98d47ae16f"}
{"level":"debug","ts":"2026-07-06T19:00:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/58bf29a02801972c7f59b1466d5bbc3c0ed035c240cdaea6a916bc01bbcd6f48","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T19:00:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e1f91f29a92736910355bd01a5ee338aa8c3cb166ff184f4e29f7f98d47ae16f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:00:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a8db3e05c0ce7a595b7845bfe4f4219f6fabcea2e7f26f378c3989d3017c5b8d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:00:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"58bf29a02801972c7f59b1466d5bbc3c0ed035c240cdaea6a916bc01bbcd6f48","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T19:00:16Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T19:00:16Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T19:00:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/58bf29a02801972c7f59b1466d5bbc3c0ed035c240cdaea6a916bc01bbcd6f48"}
{"level":"debug","ts":"2026-07-06T19:00:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/a8db3e05c0ce7a595b7845bfe4f4219f6fabcea2e7f26f378c3989d3017c5b8d","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T19:00:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"58bf29a02801972c7f59b1466d5bbc3c0ed035c240cdaea6a916bc01bbcd6f48","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:00:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e1f91f29a92736910355bd01a5ee338aa8c3cb166ff184f4e29f7f98d47ae16f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T19:00:16Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T19:00:16Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["e1f91f29a92736910355bd01a5ee338aa8c3cb166ff184f4e29f7f98d47ae16f"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T19:00:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e1f91f29a92736910355bd01a5ee338aa8c3cb166ff184f4e29f7f98d47ae16f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:00:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"58bf29a02801972c7f59b1466d5bbc3c0ed035c240cdaea6a916bc01bbcd6f48","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T19:00:16Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T19:00:16Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["58bf29a02801972c7f59b1466d5bbc3c0ed035c240cdaea6a916bc01bbcd6f48"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T19:00:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a8db3e05c0ce7a595b7845bfe4f4219f6fabcea2e7f26f378c3989d3017c5b8d"}
{"level":"debug","ts":"2026-07-06T19:00:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/e1f91f29a92736910355bd01a5ee338aa8c3cb166ff184f4e29f7f98d47ae16f","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T19:00:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"58bf29a02801972c7f59b1466d5bbc3c0ed035c240cdaea6a916bc01bbcd6f48","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:00:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e1f91f29a92736910355bd01a5ee338aa8c3cb166ff184f4e29f7f98d47ae16f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T19:00:16Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T19:00:16Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T19:00:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e1f91f29a92736910355bd01a5ee338aa8c3cb166ff184f4e29f7f98d47ae16f"}
{"level":"debug","ts":"2026-07-06T19:00:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/58bf29a02801972c7f59b1466d5bbc3c0ed035c240cdaea6a916bc01bbcd6f48","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T19:00:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e1f91f29a92736910355bd01a5ee338aa8c3cb166ff184f4e29f7f98d47ae16f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:00:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"58bf29a02801972c7f59b1466d5bbc3c0ed035c240cdaea6a916bc01bbcd6f48","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T19:00:16Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T19:00:16Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T19:00:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"58bf29a02801972c7f59b1466d5bbc3c0ed035c240cdaea6a916bc01bbcd6f48","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:00:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e1f91f29a92736910355bd01a5ee338aa8c3cb166ff184f4e29f7f98d47ae16f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T19:00:16Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T19:00:16Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["e1f91f29a92736910355bd01a5ee338aa8c3cb166ff184f4e29f7f98d47ae16f"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T19:00:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/58bf29a02801972c7f59b1466d5bbc3c0ed035c240cdaea6a916bc01bbcd6f48"}
{"level":"debug","ts":"2026-07-06T19:00:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/e1f91f29a92736910355bd01a5ee338aa8c3cb166ff184f4e29f7f98d47ae16f","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T19:00:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e1f91f29a92736910355bd01a5ee338aa8c3cb166ff184f4e29f7f98d47ae16f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:00:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"58bf29a02801972c7f59b1466d5bbc3c0ed035c240cdaea6a916bc01bbcd6f48","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T19:00:16Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T19:00:16Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["58bf29a02801972c7f59b1466d5bbc3c0ed035c240cdaea6a916bc01bbcd6f48"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T19:00:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e1f91f29a92736910355bd01a5ee338aa8c3cb166ff184f4e29f7f98d47ae16f"}
{"level":"debug","ts":"2026-07-06T19:00:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/58bf29a02801972c7f59b1466d5bbc3c0ed035c240cdaea6a916bc01bbcd6f48","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T19:00:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"58bf29a02801972c7f59b1466d5bbc3c0ed035c240cdaea6a916bc01bbcd6f48","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:00:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e1f91f29a92736910355bd01a5ee338aa8c3cb166ff184f4e29f7f98d47ae16f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:00:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"58bf29a02801972c7f59b1466d5bbc3c0ed035c240cdaea6a916bc01bbcd6f48","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T19:00:16Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T19:00:16Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T19:00:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/58bf29a02801972c7f59b1466d5bbc3c0ed035c240cdaea6a916bc01bbcd6f48"}
{"level":"debug","ts":"2026-07-06T19:00:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/e1f91f29a92736910355bd01a5ee338aa8c3cb166ff184f4e29f7f98d47ae16f","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T19:00:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"58bf29a02801972c7f59b1466d5bbc3c0ed035c240cdaea6a916bc01bbcd6f48","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:00:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"58bf29a02801972c7f59b1466d5bbc3c0ed035c240cdaea6a916bc01bbcd6f48","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T19:00:16Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T19:00:16Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["58bf29a02801972c7f59b1466d5bbc3c0ed035c240cdaea6a916bc01bbcd6f48"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T19:00:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"58bf29a02801972c7f59b1466d5bbc3c0ed035c240cdaea6a916bc01bbcd6f48","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:00:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5ec9866941ade64c99d441c372799ca42f409b0794a7903ae0c6029a45fc0056","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:00:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"58bf29a02801972c7f59b1466d5bbc3c0ed035c240cdaea6a916bc01bbcd6f48","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T19:00:16Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T19:00:16Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["58bf29a02801972c7f59b1466d5bbc3c0ed035c240cdaea6a916bc01bbcd6f48"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T19:00:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e1f91f29a92736910355bd01a5ee338aa8c3cb166ff184f4e29f7f98d47ae16f"}
{"level":"debug","ts":"2026-07-06T19:00:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/58bf29a02801972c7f59b1466d5bbc3c0ed035c240cdaea6a916bc01bbcd6f48","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"error","ts":"2026-07-06T19:00:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"58bf29a02801972c7f59b1466d5bbc3c0ed035c240cdaea6a916bc01bbcd6f48","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"58bf29a02801972c7f59b1466d5bbc3c0ed035c240cdaea6a916bc01bbcd6f48\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-06T19:00:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"58bf29a02801972c7f59b1466d5bbc3c0ed035c240cdaea6a916bc01bbcd6f48","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T19:00:16Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T19:00:16Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T19:00:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/58bf29a02801972c7f59b1466d5bbc3c0ed035c240cdaea6a916bc01bbcd6f48"}
{"level":"info","ts":"2026-07-06T19:00:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"58bf29a02801972c7f59b1466d5bbc3c0ed035c240cdaea6a916bc01bbcd6f48","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:00:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"58bf29a02801972c7f59b1466d5bbc3c0ed035c240cdaea6a916bc01bbcd6f48","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:00:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"58bf29a02801972c7f59b1466d5bbc3c0ed035c240cdaea6a916bc01bbcd6f48","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T19:00:16Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T19:00:16Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["58bf29a02801972c7f59b1466d5bbc3c0ed035c240cdaea6a916bc01bbcd6f48"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-06T19:00:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/5ec9866941ade64c99d441c372799ca42f409b0794a7903ae0c6029a45fc0056","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T19:00:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"58bf29a02801972c7f59b1466d5bbc3c0ed035c240cdaea6a916bc01bbcd6f48","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:00:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"58bf29a02801972c7f59b1466d5bbc3c0ed035c240cdaea6a916bc01bbcd6f48","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T19:00:16Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T19:00:16Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["58bf29a02801972c7f59b1466d5bbc3c0ed035c240cdaea6a916bc01bbcd6f48"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T19:00:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5ec9866941ade64c99d441c372799ca42f409b0794a7903ae0c6029a45fc0056"}
{"level":"debug","ts":"2026-07-06T19:00:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/58bf29a02801972c7f59b1466d5bbc3c0ed035c240cdaea6a916bc01bbcd6f48","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"error","ts":"2026-07-06T19:00:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"58bf29a02801972c7f59b1466d5bbc3c0ed035c240cdaea6a916bc01bbcd6f48","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"58bf29a02801972c7f59b1466d5bbc3c0ed035c240cdaea6a916bc01bbcd6f48\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-06T19:00:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"58bf29a02801972c7f59b1466d5bbc3c0ed035c240cdaea6a916bc01bbcd6f48","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T19:00:16Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T19:00:16Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T19:00:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/58bf29a02801972c7f59b1466d5bbc3c0ed035c240cdaea6a916bc01bbcd6f48"}
{"level":"debug","ts":"2026-07-06T19:00:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/58bf29a02801972c7f59b1466d5bbc3c0ed035c240cdaea6a916bc01bbcd6f48","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T19:00:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"58bf29a02801972c7f59b1466d5bbc3c0ed035c240cdaea6a916bc01bbcd6f48","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:00:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"58bf29a02801972c7f59b1466d5bbc3c0ed035c240cdaea6a916bc01bbcd6f48","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:00:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7502b45ed071984dbeda4aed13e858926b7ad79e7003a8ec77863722ce02bd5e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:00:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"58bf29a02801972c7f59b1466d5bbc3c0ed035c240cdaea6a916bc01bbcd6f48","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T19:00:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/58bf29a02801972c7f59b1466d5bbc3c0ed035c240cdaea6a916bc01bbcd6f48"}
{"level":"debug","ts":"2026-07-06T19:00:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/7502b45ed071984dbeda4aed13e858926b7ad79e7003a8ec77863722ce02bd5e","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T19:00:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7502b45ed071984dbeda4aed13e858926b7ad79e7003a8ec77863722ce02bd5e"}
{"level":"debug","ts":"2026-07-06T19:00:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"825b4e4809451f9debccbe1150b699f739c117934b0bf98871cc2a21cd18800d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T19:00:16Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T19:00:16Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-06T19:00:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/825b4e4809451f9debccbe1150b699f739c117934b0bf98871cc2a21cd18800d","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T19:00:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/825b4e4809451f9debccbe1150b699f739c117934b0bf98871cc2a21cd18800d"}
{"level":"debug","ts":"2026-07-06T19:00:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/825b4e4809451f9debccbe1150b699f739c117934b0bf98871cc2a21cd18800d","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T19:00:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"825b4e4809451f9debccbe1150b699f739c117934b0bf98871cc2a21cd18800d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:00:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"58bf29a02801972c7f59b1466d5bbc3c0ed035c240cdaea6a916bc01bbcd6f48","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T19:00:17Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T19:00:17Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["58bf29a02801972c7f59b1466d5bbc3c0ed035c240cdaea6a916bc01bbcd6f48"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T19:00:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/825b4e4809451f9debccbe1150b699f739c117934b0bf98871cc2a21cd18800d"}
{"level":"debug","ts":"2026-07-06T19:00:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/7d66c6155f092639a8500b207fd49a41c5d4137d324a46572c9aaa18ae319b20","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T19:00:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"58bf29a02801972c7f59b1466d5bbc3c0ed035c240cdaea6a916bc01bbcd6f48","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:00:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"825b4e4809451f9debccbe1150b699f739c117934b0bf98871cc2a21cd18800d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T19:00:17Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T19:00:17Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["825b4e4809451f9debccbe1150b699f739c117934b0bf98871cc2a21cd18800d"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T19:00:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7d66c6155f092639a8500b207fd49a41c5d4137d324a46572c9aaa18ae319b20"}
{"level":"debug","ts":"2026-07-06T19:00:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/58bf29a02801972c7f59b1466d5bbc3c0ed035c240cdaea6a916bc01bbcd6f48","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T19:00:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/58bf29a02801972c7f59b1466d5bbc3c0ed035c240cdaea6a916bc01bbcd6f48"}
{"level":"debug","ts":"2026-07-06T19:00:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/3a0f9c9dc56e9c56e4cc3a1a02dafc2c892dee0417dca18ab5b923374d7a6b1d","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T19:00:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"825b4e4809451f9debccbe1150b699f739c117934b0bf98871cc2a21cd18800d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:00:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7d66c6155f092639a8500b207fd49a41c5d4137d324a46572c9aaa18ae319b20","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:00:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"58bf29a02801972c7f59b1466d5bbc3c0ed035c240cdaea6a916bc01bbcd6f48","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:00:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3a0f9c9dc56e9c56e4cc3a1a02dafc2c892dee0417dca18ab5b923374d7a6b1d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T19:00:17Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T19:00:17Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T19:00:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3a0f9c9dc56e9c56e4cc3a1a02dafc2c892dee0417dca18ab5b923374d7a6b1d"}
{"level":"debug","ts":"2026-07-06T19:00:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/825b4e4809451f9debccbe1150b699f739c117934b0bf98871cc2a21cd18800d","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T19:00:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3a0f9c9dc56e9c56e4cc3a1a02dafc2c892dee0417dca18ab5b923374d7a6b1d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:00:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"825b4e4809451f9debccbe1150b699f739c117934b0bf98871cc2a21cd18800d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T19:00:17Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T19:00:17Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T19:00:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/825b4e4809451f9debccbe1150b699f739c117934b0bf98871cc2a21cd18800d"}
{"level":"debug","ts":"2026-07-06T19:00:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/3a0f9c9dc56e9c56e4cc3a1a02dafc2c892dee0417dca18ab5b923374d7a6b1d","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T19:00:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3a0f9c9dc56e9c56e4cc3a1a02dafc2c892dee0417dca18ab5b923374d7a6b1d"}
{"level":"debug","ts":"2026-07-06T19:00:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/6ca4e8b470af39adaba6d354315da786e395454d9c08b0c0f160979fb65af263","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T19:00:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"825b4e4809451f9debccbe1150b699f739c117934b0bf98871cc2a21cd18800d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:00:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3a0f9c9dc56e9c56e4cc3a1a02dafc2c892dee0417dca18ab5b923374d7a6b1d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T19:00:17Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T19:00:17Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3a0f9c9dc56e9c56e4cc3a1a02dafc2c892dee0417dca18ab5b923374d7a6b1d"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T19:00:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6ca4e8b470af39adaba6d354315da786e395454d9c08b0c0f160979fb65af263"}
{"level":"debug","ts":"2026-07-06T19:00:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/825b4e4809451f9debccbe1150b699f739c117934b0bf98871cc2a21cd18800d","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T19:00:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3a0f9c9dc56e9c56e4cc3a1a02dafc2c892dee0417dca18ab5b923374d7a6b1d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:00:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6ca4e8b470af39adaba6d354315da786e395454d9c08b0c0f160979fb65af263","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:00:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"825b4e4809451f9debccbe1150b699f739c117934b0bf98871cc2a21cd18800d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T19:00:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/825b4e4809451f9debccbe1150b699f739c117934b0bf98871cc2a21cd18800d"}
{"level":"debug","ts":"2026-07-06T19:00:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"825b4e4809451f9debccbe1150b699f739c117934b0bf98871cc2a21cd18800d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T19:00:17Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T19:00:17Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["825b4e4809451f9debccbe1150b699f739c117934b0bf98871cc2a21cd18800d"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-06T19:00:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/3a0f9c9dc56e9c56e4cc3a1a02dafc2c892dee0417dca18ab5b923374d7a6b1d","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T19:00:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"825b4e4809451f9debccbe1150b699f739c117934b0bf98871cc2a21cd18800d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:00:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3a0f9c9dc56e9c56e4cc3a1a02dafc2c892dee0417dca18ab5b923374d7a6b1d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T19:00:17Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T19:00:17Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T19:00:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3a0f9c9dc56e9c56e4cc3a1a02dafc2c892dee0417dca18ab5b923374d7a6b1d"}
{"level":"debug","ts":"2026-07-06T19:00:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/8dd963d9fdee69e495f1d79fa7b59322ec1d8328bba623f2ca62c54bb829402e","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T19:00:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3a0f9c9dc56e9c56e4cc3a1a02dafc2c892dee0417dca18ab5b923374d7a6b1d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:00:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8dd963d9fdee69e495f1d79fa7b59322ec1d8328bba623f2ca62c54bb829402e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T19:00:17Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T19:00:17Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T19:00:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8dd963d9fdee69e495f1d79fa7b59322ec1d8328bba623f2ca62c54bb829402e"}
{"level":"debug","ts":"2026-07-06T19:00:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/825b4e4809451f9debccbe1150b699f739c117934b0bf98871cc2a21cd18800d","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T19:00:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/825b4e4809451f9debccbe1150b699f739c117934b0bf98871cc2a21cd18800d"}
{"level":"debug","ts":"2026-07-06T19:00:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/3a0f9c9dc56e9c56e4cc3a1a02dafc2c892dee0417dca18ab5b923374d7a6b1d","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T19:00:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3a0f9c9dc56e9c56e4cc3a1a02dafc2c892dee0417dca18ab5b923374d7a6b1d"}
{"level":"info","ts":"2026-07-06T19:00:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8dd963d9fdee69e495f1d79fa7b59322ec1d8328bba623f2ca62c54bb829402e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:00:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"825b4e4809451f9debccbe1150b699f739c117934b0bf98871cc2a21cd18800d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:00:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3a0f9c9dc56e9c56e4cc3a1a02dafc2c892dee0417dca18ab5b923374d7a6b1d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T19:00:17Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T19:00:17Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3a0f9c9dc56e9c56e4cc3a1a02dafc2c892dee0417dca18ab5b923374d7a6b1d"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-06T19:00:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/87a150eabc7659da2832b5d5f95adaf4b9a45a76bf4b3b01eb3be5b331c1f349","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T19:00:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3a0f9c9dc56e9c56e4cc3a1a02dafc2c892dee0417dca18ab5b923374d7a6b1d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:00:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"87a150eabc7659da2832b5d5f95adaf4b9a45a76bf4b3b01eb3be5b331c1f349","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T19:00:17Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T19:00:17Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T19:00:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/87a150eabc7659da2832b5d5f95adaf4b9a45a76bf4b3b01eb3be5b331c1f349"}
{"level":"debug","ts":"2026-07-06T19:00:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/8dd963d9fdee69e495f1d79fa7b59322ec1d8328bba623f2ca62c54bb829402e","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T19:00:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"87a150eabc7659da2832b5d5f95adaf4b9a45a76bf4b3b01eb3be5b331c1f349","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:00:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8dd963d9fdee69e495f1d79fa7b59322ec1d8328bba623f2ca62c54bb829402e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:00:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"cbee4de24e7f52377467bc1c31e35371aa80bf91cd74077a1bc0ff135956cb05","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:00:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3a0f9c9dc56e9c56e4cc3a1a02dafc2c892dee0417dca18ab5b923374d7a6b1d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:00:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"87a150eabc7659da2832b5d5f95adaf4b9a45a76bf4b3b01eb3be5b331c1f349","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T19:00:17Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T19:00:17Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["87a150eabc7659da2832b5d5f95adaf4b9a45a76bf4b3b01eb3be5b331c1f349"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T19:00:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"87a150eabc7659da2832b5d5f95adaf4b9a45a76bf4b3b01eb3be5b331c1f349","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:00:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8dd963d9fdee69e495f1d79fa7b59322ec1d8328bba623f2ca62c54bb829402e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:00:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"87a150eabc7659da2832b5d5f95adaf4b9a45a76bf4b3b01eb3be5b331c1f349","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T19:00:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8dd963d9fdee69e495f1d79fa7b59322ec1d8328bba623f2ca62c54bb829402e"}
{"level":"debug","ts":"2026-07-06T19:00:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/cbee4de24e7f52377467bc1c31e35371aa80bf91cd74077a1bc0ff135956cb05","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-06T19:00:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8dd963d9fdee69e495f1d79fa7b59322ec1d8328bba623f2ca62c54bb829402e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T19:00:17Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T19:00:17Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["8dd963d9fdee69e495f1d79fa7b59322ec1d8328bba623f2ca62c54bb829402e"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T19:00:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/cbee4de24e7f52377467bc1c31e35371aa80bf91cd74077a1bc0ff135956cb05"}
{"level":"debug","ts":"2026-07-06T19:00:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/3a0f9c9dc56e9c56e4cc3a1a02dafc2c892dee0417dca18ab5b923374d7a6b1d","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T19:00:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8dd963d9fdee69e495f1d79fa7b59322ec1d8328bba623f2ca62c54bb829402e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:00:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8dd963d9fdee69e495f1d79fa7b59322ec1d8328bba623f2ca62c54bb829402e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:00:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8303d1bdcc7075b5fd8e6468df2196e7112596d35afc4edb06dccf7484f396bb","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T19:00:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3a0f9c9dc56e9c56e4cc3a1a02dafc2c892dee0417dca18ab5b923374d7a6b1d"}
{"level":"debug","ts":"2026-07-06T19:00:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/87a150eabc7659da2832b5d5f95adaf4b9a45a76bf4b3b01eb3be5b331c1f349","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T19:00:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/87a150eabc7659da2832b5d5f95adaf4b9a45a76bf4b3b01eb3be5b331c1f349"}
{"level":"debug","ts":"2026-07-06T19:00:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/8dd963d9fdee69e495f1d79fa7b59322ec1d8328bba623f2ca62c54bb829402e","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T19:00:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8dd963d9fdee69e495f1d79fa7b59322ec1d8328bba623f2ca62c54bb829402e"}
{"level":"debug","ts":"2026-07-06T19:00:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/8303d1bdcc7075b5fd8e6468df2196e7112596d35afc4edb06dccf7484f396bb","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T19:00:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8303d1bdcc7075b5fd8e6468df2196e7112596d35afc4edb06dccf7484f396bb"}
{"level":"debug","ts":"2026-07-06T19:00:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9ad78b9023cc5a240a2d2d4fa3cf6b0048402533ea66bf7e0f3025ea88619696","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T19:00:17Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T19:00:17Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-06T19:00:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/9ad78b9023cc5a240a2d2d4fa3cf6b0048402533ea66bf7e0f3025ea88619696","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T19:00:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9ad78b9023cc5a240a2d2d4fa3cf6b0048402533ea66bf7e0f3025ea88619696","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:00:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9ad78b9023cc5a240a2d2d4fa3cf6b0048402533ea66bf7e0f3025ea88619696","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T19:00:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9ad78b9023cc5a240a2d2d4fa3cf6b0048402533ea66bf7e0f3025ea88619696"}
{"level":"debug","ts":"2026-07-06T19:00:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9ad78b9023cc5a240a2d2d4fa3cf6b0048402533ea66bf7e0f3025ea88619696","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:00:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/9ad78b9023cc5a240a2d2d4fa3cf6b0048402533ea66bf7e0f3025ea88619696","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-06T19:00:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8b1d89ed651da0c2fe2c43f9b6502ed2f2a48bbb88f43f119606a9d12ac3a9a9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:00:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9ad78b9023cc5a240a2d2d4fa3cf6b0048402533ea66bf7e0f3025ea88619696","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:00:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f050fbdb2027a47041339e2497a427bf2a259f8bb025b2ff3c5540fa5031ce18","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T19:00:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9ad78b9023cc5a240a2d2d4fa3cf6b0048402533ea66bf7e0f3025ea88619696"}
{"level":"debug","ts":"2026-07-06T19:00:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/8b1d89ed651da0c2fe2c43f9b6502ed2f2a48bbb88f43f119606a9d12ac3a9a9","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T19:00:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8b1d89ed651da0c2fe2c43f9b6502ed2f2a48bbb88f43f119606a9d12ac3a9a9"}
{"level":"debug","ts":"2026-07-06T19:00:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/f050fbdb2027a47041339e2497a427bf2a259f8bb025b2ff3c5540fa5031ce18","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-06T19:00:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9ad78b9023cc5a240a2d2d4fa3cf6b0048402533ea66bf7e0f3025ea88619696","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T19:00:17Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T19:00:17Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["9ad78b9023cc5a240a2d2d4fa3cf6b0048402533ea66bf7e0f3025ea88619696"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T19:00:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f050fbdb2027a47041339e2497a427bf2a259f8bb025b2ff3c5540fa5031ce18"}
{"level":"debug","ts":"2026-07-06T19:00:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/5cbb644a58fc4f41c2dc3c9132b9d5a444d13468498b369f90ef7710141fd409","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T19:00:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9ad78b9023cc5a240a2d2d4fa3cf6b0048402533ea66bf7e0f3025ea88619696","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:00:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5cbb644a58fc4f41c2dc3c9132b9d5a444d13468498b369f90ef7710141fd409","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T19:00:17Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T19:00:17Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T19:00:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5cbb644a58fc4f41c2dc3c9132b9d5a444d13468498b369f90ef7710141fd409"}
{"level":"debug","ts":"2026-07-06T19:00:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/9ad78b9023cc5a240a2d2d4fa3cf6b0048402533ea66bf7e0f3025ea88619696","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T19:00:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5cbb644a58fc4f41c2dc3c9132b9d5a444d13468498b369f90ef7710141fd409","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:00:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9ad78b9023cc5a240a2d2d4fa3cf6b0048402533ea66bf7e0f3025ea88619696","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T19:00:17Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T19:00:17Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T19:00:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9ad78b9023cc5a240a2d2d4fa3cf6b0048402533ea66bf7e0f3025ea88619696"}
{"level":"debug","ts":"2026-07-06T19:00:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/5cbb644a58fc4f41c2dc3c9132b9d5a444d13468498b369f90ef7710141fd409","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T19:00:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9ad78b9023cc5a240a2d2d4fa3cf6b0048402533ea66bf7e0f3025ea88619696","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:00:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5cbb644a58fc4f41c2dc3c9132b9d5a444d13468498b369f90ef7710141fd409","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:00:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9ad78b9023cc5a240a2d2d4fa3cf6b0048402533ea66bf7e0f3025ea88619696","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T19:00:17Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T19:00:17Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["9ad78b9023cc5a240a2d2d4fa3cf6b0048402533ea66bf7e0f3025ea88619696"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T19:00:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5cbb644a58fc4f41c2dc3c9132b9d5a444d13468498b369f90ef7710141fd409"}
{"level":"debug","ts":"2026-07-06T19:00:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/9ad78b9023cc5a240a2d2d4fa3cf6b0048402533ea66bf7e0f3025ea88619696","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T19:00:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9ad78b9023cc5a240a2d2d4fa3cf6b0048402533ea66bf7e0f3025ea88619696","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:00:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5cbb644a58fc4f41c2dc3c9132b9d5a444d13468498b369f90ef7710141fd409","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T19:00:17Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T19:00:17Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["5cbb644a58fc4f41c2dc3c9132b9d5a444d13468498b369f90ef7710141fd409"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T19:00:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9ad78b9023cc5a240a2d2d4fa3cf6b0048402533ea66bf7e0f3025ea88619696"}
{"level":"debug","ts":"2026-07-06T19:00:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/9ad78b9023cc5a240a2d2d4fa3cf6b0048402533ea66bf7e0f3025ea88619696","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T19:00:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5cbb644a58fc4f41c2dc3c9132b9d5a444d13468498b369f90ef7710141fd409","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:00:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9ad78b9023cc5a240a2d2d4fa3cf6b0048402533ea66bf7e0f3025ea88619696","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T19:00:17Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T19:00:17Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T19:00:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9ad78b9023cc5a240a2d2d4fa3cf6b0048402533ea66bf7e0f3025ea88619696","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:00:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5cbb644a58fc4f41c2dc3c9132b9d5a444d13468498b369f90ef7710141fd409","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T19:00:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9ad78b9023cc5a240a2d2d4fa3cf6b0048402533ea66bf7e0f3025ea88619696"}
{"level":"debug","ts":"2026-07-06T19:00:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9ad78b9023cc5a240a2d2d4fa3cf6b0048402533ea66bf7e0f3025ea88619696","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T19:00:17Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T19:00:17Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["9ad78b9023cc5a240a2d2d4fa3cf6b0048402533ea66bf7e0f3025ea88619696"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-06T19:00:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/5cbb644a58fc4f41c2dc3c9132b9d5a444d13468498b369f90ef7710141fd409","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T19:00:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9ad78b9023cc5a240a2d2d4fa3cf6b0048402533ea66bf7e0f3025ea88619696","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:00:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9ad78b9023cc5a240a2d2d4fa3cf6b0048402533ea66bf7e0f3025ea88619696","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T19:00:17Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T19:00:17Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["9ad78b9023cc5a240a2d2d4fa3cf6b0048402533ea66bf7e0f3025ea88619696"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T19:00:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5cbb644a58fc4f41c2dc3c9132b9d5a444d13468498b369f90ef7710141fd409"}
{"level":"error","ts":"2026-07-06T19:00:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"9ad78b9023cc5a240a2d2d4fa3cf6b0048402533ea66bf7e0f3025ea88619696","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"9ad78b9023cc5a240a2d2d4fa3cf6b0048402533ea66bf7e0f3025ea88619696\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-06T19:00:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9ad78b9023cc5a240a2d2d4fa3cf6b0048402533ea66bf7e0f3025ea88619696","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T19:00:17Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T19:00:17Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"debug","ts":"2026-07-06T19:00:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/9ad78b9023cc5a240a2d2d4fa3cf6b0048402533ea66bf7e0f3025ea88619696","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T19:00:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9ad78b9023cc5a240a2d2d4fa3cf6b0048402533ea66bf7e0f3025ea88619696","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:00:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9ad78b9023cc5a240a2d2d4fa3cf6b0048402533ea66bf7e0f3025ea88619696","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T19:00:17Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T19:00:17Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T19:00:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9ad78b9023cc5a240a2d2d4fa3cf6b0048402533ea66bf7e0f3025ea88619696"}
{"level":"debug","ts":"2026-07-06T19:00:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/9ad78b9023cc5a240a2d2d4fa3cf6b0048402533ea66bf7e0f3025ea88619696","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"error","ts":"2026-07-06T19:00:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"9ad78b9023cc5a240a2d2d4fa3cf6b0048402533ea66bf7e0f3025ea88619696","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"9ad78b9023cc5a240a2d2d4fa3cf6b0048402533ea66bf7e0f3025ea88619696\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-06T19:00:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9ad78b9023cc5a240a2d2d4fa3cf6b0048402533ea66bf7e0f3025ea88619696","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T19:00:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9ad78b9023cc5a240a2d2d4fa3cf6b0048402533ea66bf7e0f3025ea88619696"}
{"level":"debug","ts":"2026-07-06T19:00:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9ad78b9023cc5a240a2d2d4fa3cf6b0048402533ea66bf7e0f3025ea88619696","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T19:00:17Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T19:00:17Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["9ad78b9023cc5a240a2d2d4fa3cf6b0048402533ea66bf7e0f3025ea88619696"],"numHostsReady":"1/1","numIdentitySources":3,"numMetadataSources":2,"numAuthorizationPolicies":5,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T19:00:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9ad78b9023cc5a240a2d2d4fa3cf6b0048402533ea66bf7e0f3025ea88619696","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:00:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9ad78b9023cc5a240a2d2d4fa3cf6b0048402533ea66bf7e0f3025ea88619696","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:00:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/9ad78b9023cc5a240a2d2d4fa3cf6b0048402533ea66bf7e0f3025ea88619696","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T19:00:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9ad78b9023cc5a240a2d2d4fa3cf6b0048402533ea66bf7e0f3025ea88619696"}
{"level":"info","ts":"2026-07-06T19:00:20Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"03fc97fd-df1d-4978-959d-b26c2e88428f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:41146","PortSpecifier":{"PortValue":41146}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.66:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"03fc97fd-df1d-4978-959d-b26c2e88428f","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-47f1eb.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T19:00:20Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"03fc97fd-df1d-4978-959d-b26c2e88428f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:41146","PortSpecifier":{"PortValue":41146}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.66:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783364420,"nanos":392991611},"http":{"id":"03fc97fd-df1d-4978-959d-b26c2e88428f","method":"POST","headers":{":authority":"e2e-shared-a-47f1eb.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:00:20Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"03fc97fd-df1d-4978-959d-b26c2e88428f","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-07-06T19:00:20Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"03fc97fd-df1d-4978-959d-b26c2e88428f","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-06T19:00:20Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"03fc97fd-df1d-4978-959d-b26c2e88428f","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"4c117213-6436-4d5e-b6f2-0dc80354b8ad","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=b4ed87fd-f39c-46f5-8b5f-dad8294f1243"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/6aa6542dfc28"]}}
{"level":"debug","ts":"2026-07-06T19:00:20Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"03fc97fd-df1d-4978-959d-b26c2e88428f","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/6aa6542dfc28"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=b4ed87fd-f39c-46f5-8b5f-dad8294f1243"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"4c117213-6436-4d5e-b6f2-0dc80354b8ad","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"825b4e4809451f9debccbe1150b699f739c117934b0bf98871cc2a21cd18800d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.66:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-47f1eb.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:00:20Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"03fc97fd-df1d-4978-959d-b26c2e88428f","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:00:20Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"03fc97fd-df1d-4978-959d-b26c2e88428f","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:00:20Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"03fc97fd-df1d-4978-959d-b26c2e88428f","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-47f1eb/rate-test-model-47f1eb\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:00:20Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"03fc97fd-df1d-4978-959d-b26c2e88428f","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-06T19:00:20Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"03fc97fd-df1d-4978-959d-b26c2e88428f","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-06T19:00:20Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"03fc97fd-df1d-4978-959d-b26c2e88428f","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-06T19:00:20Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"03fc97fd-df1d-4978-959d-b26c2e88428f","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T19:00:20Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"03fc97fd-df1d-4978-959d-b26c2e88428f","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T19:00:20Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f1039452-6096-4dc5-9c4c-df92c08813b9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:37762","PortSpecifier":{"PortValue":37762}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.67:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"f1039452-6096-4dc5-9c4c-df92c08813b9","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-b19850.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T19:00:20Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f1039452-6096-4dc5-9c4c-df92c08813b9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:37762","PortSpecifier":{"PortValue":37762}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.67:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783364420,"nanos":440580482},"http":{"id":"f1039452-6096-4dc5-9c4c-df92c08813b9","method":"POST","headers":{":authority":"e2e-shared-b-b19850.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:00:20Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"f1039452-6096-4dc5-9c4c-df92c08813b9","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-07-06T19:00:20Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"f1039452-6096-4dc5-9c4c-df92c08813b9","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-06T19:00:20Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"f1039452-6096-4dc5-9c4c-df92c08813b9","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"4c117213-6436-4d5e-b6f2-0dc80354b8ad","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=b4ed87fd-f39c-46f5-8b5f-dad8294f1243"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/6aa6542dfc28"]}}
{"level":"debug","ts":"2026-07-06T19:00:20Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"f1039452-6096-4dc5-9c4c-df92c08813b9","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/6aa6542dfc28"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=b4ed87fd-f39c-46f5-8b5f-dad8294f1243"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"4c117213-6436-4d5e-b6f2-0dc80354b8ad","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"cbee4de24e7f52377467bc1c31e35371aa80bf91cd74077a1bc0ff135956cb05"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.67:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-b19850.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:00:20Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f1039452-6096-4dc5-9c4c-df92c08813b9","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:00:20Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f1039452-6096-4dc5-9c4c-df92c08813b9","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:00:20Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f1039452-6096-4dc5-9c4c-df92c08813b9","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-b19850/rate-test-model-b19850\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:00:20Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"f1039452-6096-4dc5-9c4c-df92c08813b9","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-06T19:00:20Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f1039452-6096-4dc5-9c4c-df92c08813b9","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-06T19:00:20Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f1039452-6096-4dc5-9c4c-df92c08813b9","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-06T19:00:20Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f1039452-6096-4dc5-9c4c-df92c08813b9","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T19:00:20Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f1039452-6096-4dc5-9c4c-df92c08813b9","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T19:00:20Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1e64c84a-da30-44e2-a61b-94e1b7abe7c2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:41156","PortSpecifier":{"PortValue":41156}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.66:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"1e64c84a-da30-44e2-a61b-94e1b7abe7c2","method":"POST","path":"/ai-tenant-e2e-shared-a-47f1eb/rate-test-model-47f1eb/v1/completions","host":"e2e-shared-a-47f1eb.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T19:00:20Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1e64c84a-da30-44e2-a61b-94e1b7abe7c2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:41156","PortSpecifier":{"PortValue":41156}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.66:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783364420,"nanos":489712599},"http":{"id":"1e64c84a-da30-44e2-a61b-94e1b7abe7c2","method":"POST","headers":{":authority":"e2e-shared-a-47f1eb.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-47f1eb/rate-test-model-47f1eb/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:00:20Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"1e64c84a-da30-44e2-a61b-94e1b7abe7c2","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-143G2GmoWxCDLWd4b_WdVWVd8l776KBYCavLgjcbrCNkdwbcrIjpUapygrc78"}
{"level":"debug","ts":"2026-07-06T19:00:20Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"1e64c84a-da30-44e2-a61b-94e1b7abe7c2","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-47f1eb.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-143G2GmoWxCDLWd4b_WdVWVd8l776KBYCavLgjcbrCNkdwbcrIjpUapygrc78\"}"}
{"level":"debug","ts":"2026-07-06T19:00:20Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"1e64c84a-da30-44e2-a61b-94e1b7abe7c2","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-47f1eb.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"26931f17-4bd7-42c8-b500-96356bf21173","keyName":"e2e-rate-a-9cfab6","subscription":"e2e-rate-iso-a-9cfab6","tenant":"e2e-shared-a-47f1eb","userId":"26931f17-4bd7-42c8-b500-96356bf21173","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-06T19:00:20Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"1e64c84a-da30-44e2-a61b-94e1b7abe7c2","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-47f1eb.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-47f1eb/rate-test-model-47f1eb\",\"requestedSubscription\":\"e2e-rate-iso-a-9cfab6\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-06T19:00:20Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"1e64c84a-da30-44e2-a61b-94e1b7abe7c2","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-47f1eb.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-47f1eb","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-9cfab6","namespace":"ai-tenant-e2e-shared-a-47f1eb","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-06T19:00:20Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"1e64c84a-da30-44e2-a61b-94e1b7abe7c2","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:00:20Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1e64c84a-da30-44e2-a61b-94e1b7abe7c2","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:00:20Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1e64c84a-da30-44e2-a61b-94e1b7abe7c2","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:00:20Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1e64c84a-da30-44e2-a61b-94e1b7abe7c2","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-47f1eb/rate-test-model-47f1eb\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:00:20Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1e64c84a-da30-44e2-a61b-94e1b7abe7c2","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:00:20Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1e64c84a-da30-44e2-a61b-94e1b7abe7c2","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-06T19:00:20Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1e64c84a-da30-44e2-a61b-94e1b7abe7c2","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-9cfab6"}
{"level":"debug","ts":"2026-07-06T19:00:20Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1e64c84a-da30-44e2-a61b-94e1b7abe7c2","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-06T19:00:20Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1e64c84a-da30-44e2-a61b-94e1b7abe7c2","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"26931f17-4bd7-42c8-b500-96356bf21173","keyName":"e2e-rate-a-9cfab6","selected_subscription":"e2e-rate-iso-a-9cfab6","selected_subscription_key":"ai-tenant-e2e-shared-a-47f1eb/e2e-rate-iso-a-9cfab6@ai-tenant-e2e-shared-a-47f1eb/rate-test-model-47f1eb","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-47f1eb","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-9cfab6","namespace":"ai-tenant-e2e-shared-a-47f1eb","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-06T19:00:20Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1e64c84a-da30-44e2-a61b-94e1b7abe7c2","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T19:00:20Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1e64c84a-da30-44e2-a61b-94e1b7abe7c2","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T19:00:21Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"73ed3a61-1863-4900-adf9-2ecf5e7a22b3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:41172","PortSpecifier":{"PortValue":41172}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.66:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"73ed3a61-1863-4900-adf9-2ecf5e7a22b3","method":"POST","path":"/ai-tenant-e2e-shared-a-47f1eb/rate-test-model-47f1eb/v1/completions","host":"e2e-shared-a-47f1eb.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T19:00:21Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"73ed3a61-1863-4900-adf9-2ecf5e7a22b3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:41172","PortSpecifier":{"PortValue":41172}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.66:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783364421,"nanos":553819749},"http":{"id":"73ed3a61-1863-4900-adf9-2ecf5e7a22b3","method":"POST","headers":{":authority":"e2e-shared-a-47f1eb.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-47f1eb/rate-test-model-47f1eb/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:00:21Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"73ed3a61-1863-4900-adf9-2ecf5e7a22b3","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-143G2GmoWxCDLWd4b_WdVWVd8l776KBYCavLgjcbrCNkdwbcrIjpUapygrc78"}
{"level":"debug","ts":"2026-07-06T19:00:21Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"73ed3a61-1863-4900-adf9-2ecf5e7a22b3","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-47f1eb.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-143G2GmoWxCDLWd4b_WdVWVd8l776KBYCavLgjcbrCNkdwbcrIjpUapygrc78\"}"}
{"level":"debug","ts":"2026-07-06T19:00:21Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"73ed3a61-1863-4900-adf9-2ecf5e7a22b3","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-47f1eb.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"26931f17-4bd7-42c8-b500-96356bf21173","keyName":"e2e-rate-a-9cfab6","subscription":"e2e-rate-iso-a-9cfab6","tenant":"e2e-shared-a-47f1eb","userId":"26931f17-4bd7-42c8-b500-96356bf21173","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-06T19:00:21Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"73ed3a61-1863-4900-adf9-2ecf5e7a22b3","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-47f1eb.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-47f1eb/rate-test-model-47f1eb\",\"requestedSubscription\":\"e2e-rate-iso-a-9cfab6\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-06T19:00:21Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"73ed3a61-1863-4900-adf9-2ecf5e7a22b3","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-47f1eb.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-47f1eb","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-9cfab6","namespace":"ai-tenant-e2e-shared-a-47f1eb","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-06T19:00:21Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"73ed3a61-1863-4900-adf9-2ecf5e7a22b3","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:00:21Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"73ed3a61-1863-4900-adf9-2ecf5e7a22b3","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:00:21Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"73ed3a61-1863-4900-adf9-2ecf5e7a22b3","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:00:21Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"73ed3a61-1863-4900-adf9-2ecf5e7a22b3","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:00:21Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"73ed3a61-1863-4900-adf9-2ecf5e7a22b3","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-47f1eb/rate-test-model-47f1eb\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:00:21Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"73ed3a61-1863-4900-adf9-2ecf5e7a22b3","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-06T19:00:21Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"73ed3a61-1863-4900-adf9-2ecf5e7a22b3","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-06T19:00:21Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"73ed3a61-1863-4900-adf9-2ecf5e7a22b3","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-9cfab6"}
{"level":"debug","ts":"2026-07-06T19:00:21Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"73ed3a61-1863-4900-adf9-2ecf5e7a22b3","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"26931f17-4bd7-42c8-b500-96356bf21173","keyName":"e2e-rate-a-9cfab6","selected_subscription":"e2e-rate-iso-a-9cfab6","selected_subscription_key":"ai-tenant-e2e-shared-a-47f1eb/e2e-rate-iso-a-9cfab6@ai-tenant-e2e-shared-a-47f1eb/rate-test-model-47f1eb","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-47f1eb","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-9cfab6","namespace":"ai-tenant-e2e-shared-a-47f1eb","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-06T19:00:21Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"73ed3a61-1863-4900-adf9-2ecf5e7a22b3","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T19:00:21Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"73ed3a61-1863-4900-adf9-2ecf5e7a22b3","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T19:00:22Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"23a23e4d-c96d-4306-9ab9-a7c05582cd2a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:41176","PortSpecifier":{"PortValue":41176}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.66:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"23a23e4d-c96d-4306-9ab9-a7c05582cd2a","method":"POST","path":"/ai-tenant-e2e-shared-a-47f1eb/rate-test-model-47f1eb/v1/completions","host":"e2e-shared-a-47f1eb.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T19:00:22Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"23a23e4d-c96d-4306-9ab9-a7c05582cd2a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:41176","PortSpecifier":{"PortValue":41176}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.66:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783364422,"nanos":590745153},"http":{"id":"23a23e4d-c96d-4306-9ab9-a7c05582cd2a","method":"POST","headers":{":authority":"e2e-shared-a-47f1eb.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-47f1eb/rate-test-model-47f1eb/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:00:22Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"23a23e4d-c96d-4306-9ab9-a7c05582cd2a","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-143G2GmoWxCDLWd4b_WdVWVd8l776KBYCavLgjcbrCNkdwbcrIjpUapygrc78"}
{"level":"debug","ts":"2026-07-06T19:00:22Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"23a23e4d-c96d-4306-9ab9-a7c05582cd2a","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-47f1eb.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-143G2GmoWxCDLWd4b_WdVWVd8l776KBYCavLgjcbrCNkdwbcrIjpUapygrc78\"}"}
{"level":"debug","ts":"2026-07-06T19:00:22Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"23a23e4d-c96d-4306-9ab9-a7c05582cd2a","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-47f1eb.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"26931f17-4bd7-42c8-b500-96356bf21173","keyName":"e2e-rate-a-9cfab6","subscription":"e2e-rate-iso-a-9cfab6","tenant":"e2e-shared-a-47f1eb","userId":"26931f17-4bd7-42c8-b500-96356bf21173","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-06T19:00:22Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"23a23e4d-c96d-4306-9ab9-a7c05582cd2a","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-47f1eb.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-47f1eb/rate-test-model-47f1eb\",\"requestedSubscription\":\"e2e-rate-iso-a-9cfab6\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-06T19:00:22Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"23a23e4d-c96d-4306-9ab9-a7c05582cd2a","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-47f1eb.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-47f1eb","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-9cfab6","namespace":"ai-tenant-e2e-shared-a-47f1eb","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-06T19:00:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"23a23e4d-c96d-4306-9ab9-a7c05582cd2a","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:00:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"23a23e4d-c96d-4306-9ab9-a7c05582cd2a","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:00:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"23a23e4d-c96d-4306-9ab9-a7c05582cd2a","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:00:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"23a23e4d-c96d-4306-9ab9-a7c05582cd2a","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:00:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"23a23e4d-c96d-4306-9ab9-a7c05582cd2a","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-47f1eb/rate-test-model-47f1eb\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:00:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"23a23e4d-c96d-4306-9ab9-a7c05582cd2a","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-06T19:00:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"23a23e4d-c96d-4306-9ab9-a7c05582cd2a","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-9cfab6"}
{"level":"debug","ts":"2026-07-06T19:00:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"23a23e4d-c96d-4306-9ab9-a7c05582cd2a","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-06T19:00:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"23a23e4d-c96d-4306-9ab9-a7c05582cd2a","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"26931f17-4bd7-42c8-b500-96356bf21173","keyName":"e2e-rate-a-9cfab6","selected_subscription":"e2e-rate-iso-a-9cfab6","selected_subscription_key":"ai-tenant-e2e-shared-a-47f1eb/e2e-rate-iso-a-9cfab6@ai-tenant-e2e-shared-a-47f1eb/rate-test-model-47f1eb","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-47f1eb","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-9cfab6","namespace":"ai-tenant-e2e-shared-a-47f1eb","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-06T19:00:22Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"23a23e4d-c96d-4306-9ab9-a7c05582cd2a","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T19:00:22Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"23a23e4d-c96d-4306-9ab9-a7c05582cd2a","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T19:00:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/4dc577fd60594d78a4a8bebe396f4b5a928f41bdc3f95c06d717cf1ddc3158b2","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-06T19:00:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/319a353672fc7601c875fa3f8b807adf60b64f093f022b2a1c3dfef3ac8cd4f4","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-06T19:00:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/a394737442ca47bfbcb906bcf34d05c5515587984942470db6d6858608ab543a","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-06T19:00:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/e9607d3c9394ff787a7cb9306c470b1007979008e27c6d6c68281553a4653faa","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-06T19:00:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/9f3df6834dcf2df14d188decd66432f3940127e3a8261065cd3a44bd9ed1db6d","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-06T19:00:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/edcceb5a2e0cf1edde0fc3ed43068ce5b123a6fdc41949959c2c3b7a5a48bf24","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-06T19:00:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/98b96558d098c10ea5cd4b877712861a71c554909b27785cf9b672cf28954a5a","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-06T19:00:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/3c0d47082320c9bb02d3788ab2b052c696af91abc2ae438437ae71a26936c7c2","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-06T19:00:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/bf72a6316f6ed79299511e58d068836cdc71dbca5e23944f783c9340ffa0aee1","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-06T19:00:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/f9a2a1e13eaadb4f450e63a68a3d05ec02a537019380f832f5992d1c5cdee533","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-06T19:00:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/630f18b14e5ce0234d4da773011770ac52ec305a1af3397f72696bf5262056bb","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-06T19:00:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/d66f5b12bbb76f83ef1cb89313ae7356d9a4c974f276c1405eefa0cb8d66ceda","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-06T19:00:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/3774b789b89cb794db9f2ae5a4e410c6a000c480af86f9e4466977b4dc7de25a","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-06T19:00:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/ba8750633b915855593e941d13c912f4f6c6d6c6a659c241b67d178bbe85f188","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-06T19:00:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/1ef3f8313d73a7c14b76ea704cc3f23f015b2ab50034887cf570208a050e9863","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-06T19:00:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/5fea747cb803a5ee3aeb620187bd9ec74ccccd10a92474ef528215a7ff146c8f","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-06T19:00:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/01918e70442d2cb18c94316131b0e0a241b4a5d12df5b1e1981a3bef420bbdb5","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-06T19:00:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/98dd9311f361e75de96f77b800598c9f5c79c7fa539cfd493b5f7631f8efab90","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-06T19:00:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/e38d76c6f386f12bc12190c87b39e6e77e182be454f85659a9197c301f2cd9be","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-06T19:00:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/cd452b3491b4064e772f38d1a288406bb3889f19efd54af26f6554f07046a8c0","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-06T19:00:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/df733b2c652bfe2458c9e19932b1091e939c1a62178d6879462b3b4f73fca4bb","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-06T19:00:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/9bbfc0b2e9e9acadd41342cd7c36a24afa8a5eef942d161782a6adae8411158a","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-06T19:00:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/3d32277ea538e86091b57e14fc6f6582cbe1daa3e7e81223282a75b03a512083","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-06T19:00:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/3dc75fc8307b952a3e873400cf417e90f2861e8a225abec4b22708deb7901db7","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-06T19:00:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/7371c34ce8e4df2309ee8f952c87f921947b289427b6e9ea579dcb9970fc1b86","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-06T19:00:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/707878bcd632125ecab845de29fc41570ff2eb882a04dea05a2e77c0ea6d31f9","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-06T19:00:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/305bde7d554d0d2810b101d2b8d4e0e15521c2afbf16166555b8e9aa4ed39a3d","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-06T19:00:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/101d9a4d9b715268b3a3623fb114473501068b7352d534f324f4a3121b535746","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-06T19:00:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/80f10756c0e833d16937036ed66f1daf5bef95559ef05a5e852766b97b9bdaef","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-06T19:00:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/47d4519f979dd8b06fb3b12ecf63e079887e8b64c789a1ff79b4c429f3a6aa2a","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-06T19:00:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/452d598a0ad1047944cd02d3654e6793847781ecc87763544a69e05020a86cf3","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-06T19:00:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/888fdad5bc63ac36546012ce97b2af4b7b1a45ef243fd2eba72f12c306f06e3e","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-06T19:00:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/e50f5fdcb9fb7e124557afe69edae9a95d05da488eae1cc4b5c1c7c1220a826a","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-06T19:00:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-06T19:00:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/18e32965997cdd9967355c6fa5264ed12c0a215989d459ed88d7d6de02865f76","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-06T19:00:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/311b1be286674fd5684c9ac59b318287dade9769cfe4aeebd8c88e2dc6b72418","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-06T19:00:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-06T19:00:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/4375a0165d777c3dbcac3b90772aafb3ba82b742e01878423b9fb1e122337433","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-06T19:00:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/c098209e055107073c6ded1d63e221315c2239f3cf17a7d15056a7494c5714fb","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-06T19:00:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/30c4b39450ec876cfb2b0e66cbea2a74b7bcfafcf83d80a94c503487492e5a48","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-06T19:00:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/35d34d59676c333235d7c9f02273e0380bb39f27cfd30856fedc0f7c0e5f79aa","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-06T19:00:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/4325b2a5e55bf181d1f503f5c3cbce3259c00ca301216d4ea5bc6b962627f1bd","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-06T19:00:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/cc09b530b46a73b0d4ddb40e465580cff15db19d77e93e4903c9737647deeb1a","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-06T19:00:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/86cbb62fb4d82d4dc402b3281444539a5625c4bb4c86bbc4912c70e690a2e374","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-06T19:00:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/b1f82c4ba6cc7617f9c0b90067f72f4a25fdc5de2564c14ccb90af534a2905f6","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-06T19:00:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/a124e7db3701742524b9534a4ba1eb68cc6d8f337ccc26c3f8f17b958cc795d0","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-06T19:00:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/9903213c635804dd416e9f12956f0fa896195627091daaf593a30df64cf640c5","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-06T19:00:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/a89b0896df0d8cd430f1c81b6eb292ddc044daed393537d009a6330718f58d4b","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-06T19:00:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/3dd75e19cd66d310c30638e330078972afd6d2d96305f91055bc6a6f363fb8d3","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-06T19:00:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/d3b195a61a7f24c6bf1fba40f9f2e2565facb6af92e959c1546ac398a9172618","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"debug","ts":"2026-07-06T19:00:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.jwt","msg":"openid connect configuration updated","authconfig":"kuadrant-system/331dc257e65f55f80700a586f7807093eda7b3d8e7d91215dc3c47731508480c","issuerUrl":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a"}
{"level":"info","ts":"2026-07-06T19:00:33Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"28e9dced-3d08-4056-9ce8-8e3888daf88c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:49006","PortSpecifier":{"PortValue":49006}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.66:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"28e9dced-3d08-4056-9ce8-8e3888daf88c","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-47f1eb.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T19:00:33Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"28e9dced-3d08-4056-9ce8-8e3888daf88c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:49006","PortSpecifier":{"PortValue":49006}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.66:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783364433,"nanos":683409847},"http":{"id":"28e9dced-3d08-4056-9ce8-8e3888daf88c","method":"POST","headers":{":authority":"e2e-shared-a-47f1eb.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:00:33Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"28e9dced-3d08-4056-9ce8-8e3888daf88c","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-07-06T19:00:33Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"28e9dced-3d08-4056-9ce8-8e3888daf88c","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-06T19:00:33Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"28e9dced-3d08-4056-9ce8-8e3888daf88c","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"4c117213-6436-4d5e-b6f2-0dc80354b8ad","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=b4ed87fd-f39c-46f5-8b5f-dad8294f1243"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/6aa6542dfc28"]}}
{"level":"debug","ts":"2026-07-06T19:00:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"28e9dced-3d08-4056-9ce8-8e3888daf88c","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/6aa6542dfc28"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=b4ed87fd-f39c-46f5-8b5f-dad8294f1243"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"4c117213-6436-4d5e-b6f2-0dc80354b8ad","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"825b4e4809451f9debccbe1150b699f739c117934b0bf98871cc2a21cd18800d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.66:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-47f1eb.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:00:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"28e9dced-3d08-4056-9ce8-8e3888daf88c","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:00:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"28e9dced-3d08-4056-9ce8-8e3888daf88c","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:00:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"28e9dced-3d08-4056-9ce8-8e3888daf88c","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-47f1eb/rate-test-model-47f1eb\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:00:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"28e9dced-3d08-4056-9ce8-8e3888daf88c","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-06T19:00:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"28e9dced-3d08-4056-9ce8-8e3888daf88c","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-06T19:00:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"28e9dced-3d08-4056-9ce8-8e3888daf88c","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-06T19:00:33Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"28e9dced-3d08-4056-9ce8-8e3888daf88c","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T19:00:33Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"28e9dced-3d08-4056-9ce8-8e3888daf88c","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T19:00:33Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"587f690f-a9ba-4381-9004-99ac1f887815","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:54448","PortSpecifier":{"PortValue":54448}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.67:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"587f690f-a9ba-4381-9004-99ac1f887815","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-b19850.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T19:00:33Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"587f690f-a9ba-4381-9004-99ac1f887815","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:54448","PortSpecifier":{"PortValue":54448}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.67:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783364433,"nanos":723952281},"http":{"id":"587f690f-a9ba-4381-9004-99ac1f887815","method":"POST","headers":{":authority":"e2e-shared-b-b19850.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:00:33Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"587f690f-a9ba-4381-9004-99ac1f887815","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-07-06T19:00:33Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"587f690f-a9ba-4381-9004-99ac1f887815","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-06T19:00:33Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"587f690f-a9ba-4381-9004-99ac1f887815","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"4c117213-6436-4d5e-b6f2-0dc80354b8ad","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=b4ed87fd-f39c-46f5-8b5f-dad8294f1243"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/6aa6542dfc28"]}}
{"level":"debug","ts":"2026-07-06T19:00:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"587f690f-a9ba-4381-9004-99ac1f887815","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/6aa6542dfc28"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=b4ed87fd-f39c-46f5-8b5f-dad8294f1243"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"4c117213-6436-4d5e-b6f2-0dc80354b8ad","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"cbee4de24e7f52377467bc1c31e35371aa80bf91cd74077a1bc0ff135956cb05"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.67:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-b19850.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:00:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"587f690f-a9ba-4381-9004-99ac1f887815","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:00:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"587f690f-a9ba-4381-9004-99ac1f887815","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:00:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"587f690f-a9ba-4381-9004-99ac1f887815","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-b19850/rate-test-model-b19850\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:00:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"587f690f-a9ba-4381-9004-99ac1f887815","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-06T19:00:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"587f690f-a9ba-4381-9004-99ac1f887815","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-06T19:00:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"587f690f-a9ba-4381-9004-99ac1f887815","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-06T19:00:33Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"587f690f-a9ba-4381-9004-99ac1f887815","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T19:00:33Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"587f690f-a9ba-4381-9004-99ac1f887815","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T19:00:33Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7bd997b3-53e3-4d54-b470-2194f46b4470","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:49022","PortSpecifier":{"PortValue":49022}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.66:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"7bd997b3-53e3-4d54-b470-2194f46b4470","method":"POST","path":"/ai-tenant-e2e-shared-a-47f1eb/rate-test-model-47f1eb/v1/completions","host":"e2e-shared-a-47f1eb.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T19:00:33Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7bd997b3-53e3-4d54-b470-2194f46b4470","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:49022","PortSpecifier":{"PortValue":49022}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.66:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783364433,"nanos":764044541},"http":{"id":"7bd997b3-53e3-4d54-b470-2194f46b4470","method":"POST","headers":{":authority":"e2e-shared-a-47f1eb.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-47f1eb/rate-test-model-47f1eb/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:00:33Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"7bd997b3-53e3-4d54-b470-2194f46b4470","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1GF63b6DEY6Szi4tW_XYgEFLNUVxLTeaRtPc1RUidRRtcFvP1dj7OzgqCQfqB"}
{"level":"debug","ts":"2026-07-06T19:00:33Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"7bd997b3-53e3-4d54-b470-2194f46b4470","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-47f1eb.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1GF63b6DEY6Szi4tW_XYgEFLNUVxLTeaRtPc1RUidRRtcFvP1dj7OzgqCQfqB\"}"}
{"level":"debug","ts":"2026-07-06T19:00:33Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"7bd997b3-53e3-4d54-b470-2194f46b4470","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-47f1eb.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"d637848f-70e1-4cb8-a520-a94932db2639","keyName":"e2e-rate-a-dd4fe8","subscription":"e2e-rate-iso-a-dd4fe8","tenant":"e2e-shared-a-47f1eb","userId":"d637848f-70e1-4cb8-a520-a94932db2639","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-06T19:00:33Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"7bd997b3-53e3-4d54-b470-2194f46b4470","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-47f1eb.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-47f1eb/rate-test-model-47f1eb\",\"requestedSubscription\":\"e2e-rate-iso-a-dd4fe8\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-06T19:00:33Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"7bd997b3-53e3-4d54-b470-2194f46b4470","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-47f1eb.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-47f1eb","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-dd4fe8","namespace":"ai-tenant-e2e-shared-a-47f1eb","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-06T19:00:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"7bd997b3-53e3-4d54-b470-2194f46b4470","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:00:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7bd997b3-53e3-4d54-b470-2194f46b4470","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:00:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7bd997b3-53e3-4d54-b470-2194f46b4470","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:00:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7bd997b3-53e3-4d54-b470-2194f46b4470","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:00:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7bd997b3-53e3-4d54-b470-2194f46b4470","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-47f1eb/rate-test-model-47f1eb\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:00:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7bd997b3-53e3-4d54-b470-2194f46b4470","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-dd4fe8"}
{"level":"debug","ts":"2026-07-06T19:00:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7bd997b3-53e3-4d54-b470-2194f46b4470","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-06T19:00:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7bd997b3-53e3-4d54-b470-2194f46b4470","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-06T19:00:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7bd997b3-53e3-4d54-b470-2194f46b4470","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"d637848f-70e1-4cb8-a520-a94932db2639","keyName":"e2e-rate-a-dd4fe8","selected_subscription":"e2e-rate-iso-a-dd4fe8","selected_subscription_key":"ai-tenant-e2e-shared-a-47f1eb/e2e-rate-iso-a-dd4fe8@ai-tenant-e2e-shared-a-47f1eb/rate-test-model-47f1eb","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-47f1eb","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-dd4fe8","namespace":"ai-tenant-e2e-shared-a-47f1eb","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-06T19:00:33Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7bd997b3-53e3-4d54-b470-2194f46b4470","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T19:00:33Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7bd997b3-53e3-4d54-b470-2194f46b4470","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T19:00:34Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"98b043f0-cf56-47a1-a1ce-8a968ef34043","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:58432","PortSpecifier":{"PortValue":58432}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.66:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"98b043f0-cf56-47a1-a1ce-8a968ef34043","method":"POST","path":"/ai-tenant-e2e-shared-a-47f1eb/rate-test-model-47f1eb/v1/completions","host":"e2e-shared-a-47f1eb.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T19:00:34Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"98b043f0-cf56-47a1-a1ce-8a968ef34043","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:58432","PortSpecifier":{"PortValue":58432}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.66:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783364434,"nanos":799861289},"http":{"id":"98b043f0-cf56-47a1-a1ce-8a968ef34043","method":"POST","headers":{":authority":"e2e-shared-a-47f1eb.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-47f1eb/rate-test-model-47f1eb/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:00:34Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"98b043f0-cf56-47a1-a1ce-8a968ef34043","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1GF63b6DEY6Szi4tW_XYgEFLNUVxLTeaRtPc1RUidRRtcFvP1dj7OzgqCQfqB"}
{"level":"debug","ts":"2026-07-06T19:00:34Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"98b043f0-cf56-47a1-a1ce-8a968ef34043","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-47f1eb.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1GF63b6DEY6Szi4tW_XYgEFLNUVxLTeaRtPc1RUidRRtcFvP1dj7OzgqCQfqB\"}"}
{"level":"debug","ts":"2026-07-06T19:00:34Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"98b043f0-cf56-47a1-a1ce-8a968ef34043","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-47f1eb.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"d637848f-70e1-4cb8-a520-a94932db2639","keyName":"e2e-rate-a-dd4fe8","subscription":"e2e-rate-iso-a-dd4fe8","tenant":"e2e-shared-a-47f1eb","userId":"d637848f-70e1-4cb8-a520-a94932db2639","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-06T19:00:34Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"98b043f0-cf56-47a1-a1ce-8a968ef34043","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-47f1eb.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-47f1eb/rate-test-model-47f1eb\",\"requestedSubscription\":\"e2e-rate-iso-a-dd4fe8\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-06T19:00:34Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"98b043f0-cf56-47a1-a1ce-8a968ef34043","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-47f1eb.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-47f1eb","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-dd4fe8","namespace":"ai-tenant-e2e-shared-a-47f1eb","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-06T19:00:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"98b043f0-cf56-47a1-a1ce-8a968ef34043","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:00:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"98b043f0-cf56-47a1-a1ce-8a968ef34043","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:00:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"98b043f0-cf56-47a1-a1ce-8a968ef34043","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:00:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"98b043f0-cf56-47a1-a1ce-8a968ef34043","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-47f1eb/rate-test-model-47f1eb\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:00:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"98b043f0-cf56-47a1-a1ce-8a968ef34043","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:00:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"98b043f0-cf56-47a1-a1ce-8a968ef34043","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-06T19:00:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"98b043f0-cf56-47a1-a1ce-8a968ef34043","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-06T19:00:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"98b043f0-cf56-47a1-a1ce-8a968ef34043","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-dd4fe8"}
{"level":"debug","ts":"2026-07-06T19:00:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"98b043f0-cf56-47a1-a1ce-8a968ef34043","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"d637848f-70e1-4cb8-a520-a94932db2639","keyName":"e2e-rate-a-dd4fe8","selected_subscription":"e2e-rate-iso-a-dd4fe8","selected_subscription_key":"ai-tenant-e2e-shared-a-47f1eb/e2e-rate-iso-a-dd4fe8@ai-tenant-e2e-shared-a-47f1eb/rate-test-model-47f1eb","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-47f1eb","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-dd4fe8","namespace":"ai-tenant-e2e-shared-a-47f1eb","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-06T19:00:34Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"98b043f0-cf56-47a1-a1ce-8a968ef34043","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T19:00:34Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"98b043f0-cf56-47a1-a1ce-8a968ef34043","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T19:00:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b4e629b5-799a-47fb-8376-7dca7bc2c7cb","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:58446","PortSpecifier":{"PortValue":58446}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.66:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"b4e629b5-799a-47fb-8376-7dca7bc2c7cb","method":"POST","path":"/ai-tenant-e2e-shared-a-47f1eb/rate-test-model-47f1eb/v1/completions","host":"e2e-shared-a-47f1eb.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T19:00:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b4e629b5-799a-47fb-8376-7dca7bc2c7cb","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:58446","PortSpecifier":{"PortValue":58446}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.66:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783364435,"nanos":833545925},"http":{"id":"b4e629b5-799a-47fb-8376-7dca7bc2c7cb","method":"POST","headers":{":authority":"e2e-shared-a-47f1eb.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-47f1eb/rate-test-model-47f1eb/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:00:35Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"b4e629b5-799a-47fb-8376-7dca7bc2c7cb","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1GF63b6DEY6Szi4tW_XYgEFLNUVxLTeaRtPc1RUidRRtcFvP1dj7OzgqCQfqB"}
{"level":"debug","ts":"2026-07-06T19:00:35Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"b4e629b5-799a-47fb-8376-7dca7bc2c7cb","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-47f1eb.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1GF63b6DEY6Szi4tW_XYgEFLNUVxLTeaRtPc1RUidRRtcFvP1dj7OzgqCQfqB\"}"}
{"level":"debug","ts":"2026-07-06T19:00:35Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"b4e629b5-799a-47fb-8376-7dca7bc2c7cb","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-47f1eb.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"d637848f-70e1-4cb8-a520-a94932db2639","keyName":"e2e-rate-a-dd4fe8","subscription":"e2e-rate-iso-a-dd4fe8","tenant":"e2e-shared-a-47f1eb","userId":"d637848f-70e1-4cb8-a520-a94932db2639","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-06T19:00:35Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"b4e629b5-799a-47fb-8376-7dca7bc2c7cb","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-47f1eb.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-47f1eb/rate-test-model-47f1eb\",\"requestedSubscription\":\"e2e-rate-iso-a-dd4fe8\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-06T19:00:35Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"b4e629b5-799a-47fb-8376-7dca7bc2c7cb","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-47f1eb.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-47f1eb","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-dd4fe8","namespace":"ai-tenant-e2e-shared-a-47f1eb","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-06T19:00:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"b4e629b5-799a-47fb-8376-7dca7bc2c7cb","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:00:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b4e629b5-799a-47fb-8376-7dca7bc2c7cb","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:00:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b4e629b5-799a-47fb-8376-7dca7bc2c7cb","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:00:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b4e629b5-799a-47fb-8376-7dca7bc2c7cb","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:00:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b4e629b5-799a-47fb-8376-7dca7bc2c7cb","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-47f1eb/rate-test-model-47f1eb\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:00:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b4e629b5-799a-47fb-8376-7dca7bc2c7cb","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-06T19:00:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b4e629b5-799a-47fb-8376-7dca7bc2c7cb","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-dd4fe8"}
{"level":"debug","ts":"2026-07-06T19:00:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b4e629b5-799a-47fb-8376-7dca7bc2c7cb","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-06T19:00:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b4e629b5-799a-47fb-8376-7dca7bc2c7cb","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"d637848f-70e1-4cb8-a520-a94932db2639","keyName":"e2e-rate-a-dd4fe8","selected_subscription":"e2e-rate-iso-a-dd4fe8","selected_subscription_key":"ai-tenant-e2e-shared-a-47f1eb/e2e-rate-iso-a-dd4fe8@ai-tenant-e2e-shared-a-47f1eb/rate-test-model-47f1eb","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-47f1eb","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-dd4fe8","namespace":"ai-tenant-e2e-shared-a-47f1eb","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-06T19:00:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b4e629b5-799a-47fb-8376-7dca7bc2c7cb","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T19:00:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b4e629b5-799a-47fb-8376-7dca7bc2c7cb","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T19:00:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"95b79980-89d1-4921-98b3-1ab628543a0f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:50138","PortSpecifier":{"PortValue":50138}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.67:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"95b79980-89d1-4921-98b3-1ab628543a0f","method":"POST","path":"/ai-tenant-e2e-shared-b-b19850/rate-test-model-b19850/v1/completions","host":"e2e-shared-b-b19850.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T19:00:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"95b79980-89d1-4921-98b3-1ab628543a0f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:50138","PortSpecifier":{"PortValue":50138}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.67:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783364435,"nanos":867124485},"http":{"id":"95b79980-89d1-4921-98b3-1ab628543a0f","method":"POST","headers":{":authority":"e2e-shared-b-b19850.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-b-b19850/rate-test-model-b19850/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:00:35Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"95b79980-89d1-4921-98b3-1ab628543a0f","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-riaVn6QBf9U5zDw5_4oQ68MRqmCtRMhsqCNxLZXMhpipmhjIwWsD7Xq5A5Ie"}
{"level":"debug","ts":"2026-07-06T19:00:35Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"95b79980-89d1-4921-98b3-1ab628543a0f","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-b-b19850.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-riaVn6QBf9U5zDw5_4oQ68MRqmCtRMhsqCNxLZXMhpipmhjIwWsD7Xq5A5Ie\"}"}
{"level":"debug","ts":"2026-07-06T19:00:35Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"95b79980-89d1-4921-98b3-1ab628543a0f","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-b19850.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"13b16411-61f5-480d-8a71-b4a24c0cd3bd","keyName":"e2e-rate-b-dd4fe8","subscription":"e2e-rate-iso-b-dd4fe8","tenant":"e2e-shared-b-b19850","userId":"13b16411-61f5-480d-8a71-b4a24c0cd3bd","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-06T19:00:35Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"95b79980-89d1-4921-98b3-1ab628543a0f","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-b-b19850.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-b-b19850/rate-test-model-b19850\",\"requestedSubscription\":\"e2e-rate-iso-b-dd4fe8\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-06T19:00:35Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"95b79980-89d1-4921-98b3-1ab628543a0f","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-b19850.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-b19850","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-dd4fe8","namespace":"ai-tenant-e2e-shared-b-b19850","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-06T19:00:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"95b79980-89d1-4921-98b3-1ab628543a0f","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:00:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"95b79980-89d1-4921-98b3-1ab628543a0f","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:00:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"95b79980-89d1-4921-98b3-1ab628543a0f","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:00:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"95b79980-89d1-4921-98b3-1ab628543a0f","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:00:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"95b79980-89d1-4921-98b3-1ab628543a0f","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-b19850/rate-test-model-b19850\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:00:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"95b79980-89d1-4921-98b3-1ab628543a0f","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-06T19:00:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"95b79980-89d1-4921-98b3-1ab628543a0f","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-b-dd4fe8"}
{"level":"debug","ts":"2026-07-06T19:00:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"95b79980-89d1-4921-98b3-1ab628543a0f","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-06T19:00:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"95b79980-89d1-4921-98b3-1ab628543a0f","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"13b16411-61f5-480d-8a71-b4a24c0cd3bd","keyName":"e2e-rate-b-dd4fe8","selected_subscription":"e2e-rate-iso-b-dd4fe8","selected_subscription_key":"ai-tenant-e2e-shared-b-b19850/e2e-rate-iso-b-dd4fe8@ai-tenant-e2e-shared-b-b19850/rate-test-model-b19850","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-b19850","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-dd4fe8","namespace":"ai-tenant-e2e-shared-b-b19850","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-06T19:00:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"95b79980-89d1-4921-98b3-1ab628543a0f","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T19:00:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"95b79980-89d1-4921-98b3-1ab628543a0f","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T19:00:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3a345f70-0fca-41c1-945a-88ac82b44baf","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:42130","PortSpecifier":{"PortValue":42130}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"3a345f70-0fca-41c1-945a-88ac82b44baf","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T19:00:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3a345f70-0fca-41c1-945a-88ac82b44baf","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:42130","PortSpecifier":{"PortValue":42130}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783364439,"nanos":336791577},"http":{"id":"3a345f70-0fca-41c1-945a-88ac82b44baf","method":"POST","headers":{":authority":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:00:39Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"3a345f70-0fca-41c1-945a-88ac82b44baf","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783364499,"groups":["Engineering","Project-Alpha"],"iat":1783364439,"iss":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:45577ee1-1589-3438-8d05-8c5e9ba63878","preferred_username":"alice_lead","scope":"profile email","sid":"VOhY1qyw6Gz0dMPClchrzLbv","sub":"6b999d16-f5e5-4abd-a9f7-94a7ee89c01f","typ":"Bearer"}}
{"level":"debug","ts":"2026-07-06T19:00:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"3a345f70-0fca-41c1-945a-88ac82b44baf","input":{"auth":{"identity":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783364499,"groups":["Engineering","Project-Alpha"],"iat":1783364439,"iss":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:45577ee1-1589-3438-8d05-8c5e9ba63878","preferred_username":"alice_lead","scope":"profile email","sid":"VOhY1qyw6Gz0dMPClchrzLbv","sub":"6b999d16-f5e5-4abd-a9f7-94a7ee89c01f","typ":"Bearer"}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.44:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:00:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3a345f70-0fca-41c1-945a-88ac82b44baf","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:00:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3a345f70-0fca-41c1-945a-88ac82b44baf","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:00:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3a345f70-0fca-41c1-945a-88ac82b44baf","config":{"Name":"oidc-groups-safe","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OPA":{"Rego":"unsafe_group[g] {\n\tg := input.auth.identity.groups[_]\n\tnot regex.match(\"^[A-Za-z0-9:._/-]+$\", g)\n}\n\nallow {\n\tcount(unsafe_group) == 0\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:00:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3a345f70-0fca-41c1-945a-88ac82b44baf","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:00:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"3a345f70-0fca-41c1-945a-88ac82b44baf","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-06T19:00:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3a345f70-0fca-41c1-945a-88ac82b44baf","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-06T19:00:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3a345f70-0fca-41c1-945a-88ac82b44baf","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"info","ts":"2026-07-06T19:00:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3a345f70-0fca-41c1-945a-88ac82b44baf","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T19:00:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3a345f70-0fca-41c1-945a-88ac82b44baf","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T19:00:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a4ec0e5c-7f95-4c16-bc1d-89878526fe1f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:42146","PortSpecifier":{"PortValue":42146}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"a4ec0e5c-7f95-4c16-bc1d-89878526fe1f","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T19:00:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a4ec0e5c-7f95-4c16-bc1d-89878526fe1f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:42146","PortSpecifier":{"PortValue":42146}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783364439,"nanos":451634540},"http":{"id":"a4ec0e5c-7f95-4c16-bc1d-89878526fe1f","method":"POST","headers":{":authority":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:00:39Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"a4ec0e5c-7f95-4c16-bc1d-89878526fe1f","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-07-06T19:00:39Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"a4ec0e5c-7f95-4c16-bc1d-89878526fe1f","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-06T19:00:39Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"a4ec0e5c-7f95-4c16-bc1d-89878526fe1f","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"not authenticated"}
{"level":"info","ts":"2026-07-06T19:00:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a4ec0e5c-7f95-4c16-bc1d-89878526fe1f","authorized":false,"response":"UNAUTHENTICATED","object":{"code":16,"status":401,"message":"Authentication required"}}
{"level":"debug","ts":"2026-07-06T19:00:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a4ec0e5c-7f95-4c16-bc1d-89878526fe1f","authorized":false,"response":"UNAUTHENTICATED","object":{"code":16,"status":401,"message":"Authentication required","headers":[{"WWW-Authenticate":"request.headers.authorization realm=\"api-keys\""},{"WWW-Authenticate":"Bearer **** realm=\"openshift-identities\""}]}}
{"level":"info","ts":"2026-07-06T19:00:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"53cb3d46-74f6-4b43-93a5-0feefa2a3bca","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:42162","PortSpecifier":{"PortValue":42162}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"53cb3d46-74f6-4b43-93a5-0feefa2a3bca","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T19:00:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"53cb3d46-74f6-4b43-93a5-0feefa2a3bca","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:42162","PortSpecifier":{"PortValue":42162}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783364439,"nanos":556992176},"http":{"id":"53cb3d46-74f6-4b43-93a5-0feefa2a3bca","method":"POST","headers":{":authority":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer","content-length":"35","content-type":"application/json","forwarded":"for=34.228.250.194;host=maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com;proto=https","user-agent":"python-requests/2.32.5","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.9","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctcDVuYjQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.44~maas-default-gateway-openshift-default-56654dcf7-p5nb4.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"34.228.250.194,10.133.0.9","x-forwarded-host":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com","x-forwarded-port":"443","x-forwarded-proto":"https","x-request-id":"53cb3d46-74f6-4b43-93a5-0feefa2a3bca"},"path":"/maas-api/v1/api-keys","host":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com","scheme":"https","protocol":"HTTP/1.1"}},"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"metadata_context":{}}}
{"level":"debug","ts":"2026-07-06T19:00:39Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"53cb3d46-74f6-4b43-93a5-0feefa2a3bca","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"credential not found"}
{"level":"info","ts":"2026-07-06T19:00:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"53cb3d46-74f6-4b43-93a5-0feefa2a3bca","authorized":false,"response":"UNAUTHENTICATED","object":{"code":16,"status":401,"message":"Authentication required"}}
{"level":"debug","ts":"2026-07-06T19:00:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"53cb3d46-74f6-4b43-93a5-0feefa2a3bca","authorized":false,"response":"UNAUTHENTICATED","object":{"code":16,"status":401,"message":"Authentication required","headers":[{"WWW-Authenticate":"request.headers.authorization realm=\"api-keys\""},{"WWW-Authenticate":"Bearer **** realm=\"openshift-identities\""}]}}
{"level":"info","ts":"2026-07-06T19:00:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"54392383-6941-41a2-95a4-af024a4c6f43","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:42176","PortSpecifier":{"PortValue":42176}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"54392383-6941-41a2-95a4-af024a4c6f43","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T19:00:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"54392383-6941-41a2-95a4-af024a4c6f43","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:42176","PortSpecifier":{"PortValue":42176}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783364439,"nanos":582814619},"http":{"id":"54392383-6941-41a2-95a4-af024a4c6f43","method":"POST","headers":{":authority":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","content-length":"36","content-type":"application/json","forwarded":"for=34.228.250.194;host=maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com;proto=https","user-agent":"python-requests/2.32.5","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.9","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctcDVuYjQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.44~maas-default-gateway-openshift-default-56654dcf7-p5nb4.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"34.228.250.194,10.133.0.9","x-forwarded-host":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com","x-forwarded-port":"443","x-forwarded-proto":"https","x-request-id":"54392383-6941-41a2-95a4-af024a4c6f43"},"path":"/maas-api/v1/api-keys","host":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com","scheme":"https","protocol":"HTTP/1.1"}},"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"metadata_context":{}}}
{"level":"info","ts":"2026-07-06T19:00:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"54392383-6941-41a2-95a4-af024a4c6f43","authorized":false,"response":"UNAUTHENTICATED","object":{"code":16,"status":401,"message":"Authentication required"}}
{"level":"debug","ts":"2026-07-06T19:00:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"54392383-6941-41a2-95a4-af024a4c6f43","authorized":false,"response":"UNAUTHENTICATED","object":{"code":16,"status":401,"message":"Authentication required","headers":[{"WWW-Authenticate":"request.headers.authorization realm=\"api-keys\""},{"WWW-Authenticate":"Bearer **** realm=\"openshift-identities\""}]}}
{"level":"info","ts":"2026-07-06T19:00:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c2aab7b4-5583-4d0c-9901-a247e83d06ef","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:42184","PortSpecifier":{"PortValue":42184}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"c2aab7b4-5583-4d0c-9901-a247e83d06ef","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T19:00:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c2aab7b4-5583-4d0c-9901-a247e83d06ef","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:42184","PortSpecifier":{"PortValue":42184}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783364439,"nanos":670406707},"http":{"id":"c2aab7b4-5583-4d0c-9901-a247e83d06ef","method":"POST","headers":{":authority":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:00:39Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"c2aab7b4-5583-4d0c-9901-a247e83d06ef","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"oidc: token is expired (Token Expiry: 2026-07-06 18:00:39 +0000 UTC)"}
{"level":"debug","ts":"2026-07-06T19:00:39Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"c2aab7b4-5583-4d0c-9901-a247e83d06ef","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-06T19:00:39Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"c2aab7b4-5583-4d0c-9901-a247e83d06ef","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"not authenticated"}
{"level":"info","ts":"2026-07-06T19:00:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c2aab7b4-5583-4d0c-9901-a247e83d06ef","authorized":false,"response":"UNAUTHENTICATED","object":{"code":16,"status":401,"message":"Authentication required"}}
{"level":"debug","ts":"2026-07-06T19:00:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c2aab7b4-5583-4d0c-9901-a247e83d06ef","authorized":false,"response":"UNAUTHENTICATED","object":{"code":16,"status":401,"message":"Authentication required","headers":[{"WWW-Authenticate":"request.headers.authorization realm=\"api-keys\""},{"WWW-Authenticate":"Bearer **** realm=\"openshift-identities\""}]}}
{"level":"info","ts":"2026-07-06T19:00:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/87a150eabc7659da2832b5d5f95adaf4b9a45a76bf4b3b01eb3be5b331c1f349"}
{"level":"info","ts":"2026-07-06T19:00:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/8dd963d9fdee69e495f1d79fa7b59322ec1d8328bba623f2ca62c54bb829402e"}
{"level":"info","ts":"2026-07-06T19:00:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/7502b45ed071984dbeda4aed13e858926b7ad79e7003a8ec77863722ce02bd5e"}
{"level":"info","ts":"2026-07-06T19:00:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/5ec9866941ade64c99d441c372799ca42f409b0794a7903ae0c6029a45fc0056"}
{"level":"info","ts":"2026-07-06T19:00:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/8303d1bdcc7075b5fd8e6468df2196e7112596d35afc4edb06dccf7484f396bb"}
{"level":"info","ts":"2026-07-06T19:00:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/58bf29a02801972c7f59b1466d5bbc3c0ed035c240cdaea6a916bc01bbcd6f48"}
{"level":"info","ts":"2026-07-06T19:00:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/147688dfcb763649fb21d37d56b8c9a5eaea30776c327a0ad88421eb8647437d"}
{"level":"info","ts":"2026-07-06T19:00:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/6ca4e8b470af39adaba6d354315da786e395454d9c08b0c0f160979fb65af263"}
{"level":"info","ts":"2026-07-06T19:00:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/5cbb644a58fc4f41c2dc3c9132b9d5a444d13468498b369f90ef7710141fd409"}
{"level":"info","ts":"2026-07-06T19:00:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/9ad78b9023cc5a240a2d2d4fa3cf6b0048402533ea66bf7e0f3025ea88619696"}
{"level":"info","ts":"2026-07-06T19:00:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/f050fbdb2027a47041339e2497a427bf2a259f8bb025b2ff3c5540fa5031ce18"}
{"level":"info","ts":"2026-07-06T19:00:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/8b1d89ed651da0c2fe2c43f9b6502ed2f2a48bbb88f43f119606a9d12ac3a9a9"}
{"level":"info","ts":"2026-07-06T19:00:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/3a0f9c9dc56e9c56e4cc3a1a02dafc2c892dee0417dca18ab5b923374d7a6b1d"}
{"level":"info","ts":"2026-07-06T19:00:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/a8db3e05c0ce7a595b7845bfe4f4219f6fabcea2e7f26f378c3989d3017c5b8d"}
{"level":"info","ts":"2026-07-06T19:00:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/e1f91f29a92736910355bd01a5ee338aa8c3cb166ff184f4e29f7f98d47ae16f"}
{"level":"info","ts":"2026-07-06T19:00:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/7d66c6155f092639a8500b207fd49a41c5d4137d324a46572c9aaa18ae319b20"}
{"level":"info","ts":"2026-07-06T19:01:44Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e7f76ec5-aa3e-4b6b-8b90-82ac2c1f0f59","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:59380","PortSpecifier":{"PortValue":59380}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"e7f76ec5-aa3e-4b6b-8b90-82ac2c1f0f59","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T19:01:44Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e7f76ec5-aa3e-4b6b-8b90-82ac2c1f0f59","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:59380","PortSpecifier":{"PortValue":59380}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783364504,"nanos":786249713},"http":{"id":"e7f76ec5-aa3e-4b6b-8b90-82ac2c1f0f59","method":"POST","headers":{":authority":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:01:44Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"e7f76ec5-aa3e-4b6b-8b90-82ac2c1f0f59","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"oidc: token is expired (Token Expiry: 2026-07-06 19:01:39 +0000 UTC)"}
{"level":"debug","ts":"2026-07-06T19:01:44Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"e7f76ec5-aa3e-4b6b-8b90-82ac2c1f0f59","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-06T19:01:44Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"e7f76ec5-aa3e-4b6b-8b90-82ac2c1f0f59","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"not authenticated"}
{"level":"info","ts":"2026-07-06T19:01:44Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e7f76ec5-aa3e-4b6b-8b90-82ac2c1f0f59","authorized":false,"response":"UNAUTHENTICATED","object":{"code":16,"status":401,"message":"Authentication required"}}
{"level":"debug","ts":"2026-07-06T19:01:44Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e7f76ec5-aa3e-4b6b-8b90-82ac2c1f0f59","authorized":false,"response":"UNAUTHENTICATED","object":{"code":16,"status":401,"message":"Authentication required","headers":[{"WWW-Authenticate":"request.headers.authorization realm=\"api-keys\""},{"WWW-Authenticate":"Bearer **** realm=\"openshift-identities\""}]}}
{"level":"info","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7ecec448-77ca-4413-8b50-a05486b94b6e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:59384","PortSpecifier":{"PortValue":59384}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"7ecec448-77ca-4413-8b50-a05486b94b6e","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7ecec448-77ca-4413-8b50-a05486b94b6e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:59384","PortSpecifier":{"PortValue":59384}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783364505,"nanos":232778284},"http":{"id":"7ecec448-77ca-4413-8b50-a05486b94b6e","method":"POST","headers":{":authority":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"7ecec448-77ca-4413-8b50-a05486b94b6e","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783364565,"groups":["Site-Reliability"],"iat":1783364505,"iss":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:c3a6090f-8a89-76f4-9f01-df17a17f5cb4","preferred_username":"bob_sre","scope":"profile email","sid":"CWXnOsDtuPBdKm-8S4BnTtLG","sub":"fdf43355-8302-4a9a-9bcd-e7f0d0a3a147","typ":"Bearer"}}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"7ecec448-77ca-4413-8b50-a05486b94b6e","input":{"auth":{"identity":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783364565,"groups":["Site-Reliability"],"iat":1783364505,"iss":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:c3a6090f-8a89-76f4-9f01-df17a17f5cb4","preferred_username":"bob_sre","scope":"profile email","sid":"CWXnOsDtuPBdKm-8S4BnTtLG","sub":"fdf43355-8302-4a9a-9bcd-e7f0d0a3a147","typ":"Bearer"}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.44:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7ecec448-77ca-4413-8b50-a05486b94b6e","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7ecec448-77ca-4413-8b50-a05486b94b6e","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7ecec448-77ca-4413-8b50-a05486b94b6e","config":{"Name":"oidc-groups-safe","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OPA":{"Rego":"unsafe_group[g] {\n\tg := input.auth.identity.groups[_]\n\tnot regex.match(\"^[A-Za-z0-9:._/-]+$\", g)\n}\n\nallow {\n\tcount(unsafe_group) == 0\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7ecec448-77ca-4413-8b50-a05486b94b6e","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"7ecec448-77ca-4413-8b50-a05486b94b6e","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7ecec448-77ca-4413-8b50-a05486b94b6e","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"bob_sre"}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7ecec448-77ca-4413-8b50-a05486b94b6e","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Site-Reliability\"]"}
{"level":"info","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7ecec448-77ca-4413-8b50-a05486b94b6e","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7ecec448-77ca-4413-8b50-a05486b94b6e","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a4beb8a6-fcd8-4eba-a7d9-44b84ecc93b6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:59388","PortSpecifier":{"PortValue":59388}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"a4beb8a6-fcd8-4eba-a7d9-44b84ecc93b6","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a4beb8a6-fcd8-4eba-a7d9-44b84ecc93b6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:59388","PortSpecifier":{"PortValue":59388}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783364505,"nanos":466815425},"http":{"id":"a4beb8a6-fcd8-4eba-a7d9-44b84ecc93b6","method":"POST","headers":{":authority":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"a4beb8a6-fcd8-4eba-a7d9-44b84ecc93b6","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783364565,"groups":["Engineering","Project-Alpha"],"iat":1783364505,"iss":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:98cf0e6f-e535-4c0c-18b4-28f6a618d923","preferred_username":"alice_lead","scope":"profile email","sid":"QNiVr2CHMRTg6LbB1vdZ5tBx","sub":"6b999d16-f5e5-4abd-a9f7-94a7ee89c01f","typ":"Bearer"}}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"a4beb8a6-fcd8-4eba-a7d9-44b84ecc93b6","input":{"auth":{"identity":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783364565,"groups":["Engineering","Project-Alpha"],"iat":1783364505,"iss":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:98cf0e6f-e535-4c0c-18b4-28f6a618d923","preferred_username":"alice_lead","scope":"profile email","sid":"QNiVr2CHMRTg6LbB1vdZ5tBx","sub":"6b999d16-f5e5-4abd-a9f7-94a7ee89c01f","typ":"Bearer"}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.44:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a4beb8a6-fcd8-4eba-a7d9-44b84ecc93b6","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a4beb8a6-fcd8-4eba-a7d9-44b84ecc93b6","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a4beb8a6-fcd8-4eba-a7d9-44b84ecc93b6","config":{"Name":"oidc-groups-safe","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OPA":{"Rego":"unsafe_group[g] {\n\tg := input.auth.identity.groups[_]\n\tnot regex.match(\"^[A-Za-z0-9:._/-]+$\", g)\n}\n\nallow {\n\tcount(unsafe_group) == 0\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a4beb8a6-fcd8-4eba-a7d9-44b84ecc93b6","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"a4beb8a6-fcd8-4eba-a7d9-44b84ecc93b6","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a4beb8a6-fcd8-4eba-a7d9-44b84ecc93b6","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a4beb8a6-fcd8-4eba-a7d9-44b84ecc93b6","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"info","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a4beb8a6-fcd8-4eba-a7d9-44b84ecc93b6","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a4beb8a6-fcd8-4eba-a7d9-44b84ecc93b6","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5b13920c-35ba-47be-9723-8af8a6655542","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:59400","PortSpecifier":{"PortValue":59400}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"5b13920c-35ba-47be-9723-8af8a6655542","method":"GET","path":"/maas-api/v1/models","host":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5b13920c-35ba-47be-9723-8af8a6655542","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:59400","PortSpecifier":{"PortValue":59400}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783364505,"nanos":500022586},"http":{"id":"5b13920c-35ba-47be-9723-8af8a6655542","method":"GET","headers":{":authority":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"5b13920c-35ba-47be-9723-8af8a6655542","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-yp2hZnKZd6kDtxtU_W9yCwZIleoJcfs9tVEcdV5jlf1PPtGWlKXCMFBWE2l3"}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"5b13920c-35ba-47be-9723-8af8a6655542","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-yp2hZnKZd6kDtxtU_W9yCwZIleoJcfs9tVEcdV5jlf1PPtGWlKXCMFBWE2l3\"}"}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"5b13920c-35ba-47be-9723-8af8a6655542","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","Engineering","Project-Alpha"],"keyId":"eb888f9a-1d17-4b28-bee6-e4754f17c8cf","keyName":"e2e-oidc-2c431c6e","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"eb888f9a-1d17-4b28-bee6-e4754f17c8cf","username":"alice_lead","valid":true}}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"5b13920c-35ba-47be-9723-8af8a6655542","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5b13920c-35ba-47be-9723-8af8a6655542","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5b13920c-35ba-47be-9723-8af8a6655542","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5b13920c-35ba-47be-9723-8af8a6655542","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5b13920c-35ba-47be-9723-8af8a6655542","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"5b13920c-35ba-47be-9723-8af8a6655542","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5b13920c-35ba-47be-9723-8af8a6655542","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5b13920c-35ba-47be-9723-8af8a6655542","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"info","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5b13920c-35ba-47be-9723-8af8a6655542","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5b13920c-35ba-47be-9723-8af8a6655542","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2bb4e046-595b-4b52-b1a1-31d3a4c9712d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.33:51492","PortSpecifier":{"PortValue":51492}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"2bb4e046-595b-4b52-b1a1-31d3a4c9712d","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2bb4e046-595b-4b52-b1a1-31d3a4c9712d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.33:51492","PortSpecifier":{"PortValue":51492}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783364505,"nanos":528240636},"http":{"id":"2bb4e046-595b-4b52-b1a1-31d3a4c9712d","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"2bb4e046-595b-4b52-b1a1-31d3a4c9712d","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-yp2hZnKZd6kDtxtU_W9yCwZIleoJcfs9tVEcdV5jlf1PPtGWlKXCMFBWE2l3"}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"2bb4e046-595b-4b52-b1a1-31d3a4c9712d","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-yp2hZnKZd6kDtxtU_W9yCwZIleoJcfs9tVEcdV5jlf1PPtGWlKXCMFBWE2l3\"}"}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"2bb4e046-595b-4b52-b1a1-31d3a4c9712d","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","Engineering","Project-Alpha"],"keyId":"eb888f9a-1d17-4b28-bee6-e4754f17c8cf","keyName":"e2e-oidc-2c431c6e","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"eb888f9a-1d17-4b28-bee6-e4754f17c8cf","username":"alice_lead","valid":true}}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"2bb4e046-595b-4b52-b1a1-31d3a4c9712d","config":"subscription-info","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"],\"requestedModel\":\"llm/facebook-opt-125m-simulated\",\"requestedSubscription\":\"simulator-subscription\",\"username\":\"alice_lead\"}"}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"2bb4e046-595b-4b52-b1a1-31d3a4c9712d","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true}}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"2bb4e046-595b-4b52-b1a1-31d3a4c9712d","input":{"auth":{"identity":"Bearer **** subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true}}},"context":{"context_extensions":{"host":"4375a0165d777c3dbcac3b90772aafb3ba82b742e01878423b9fb1e122337433"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.44:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** sk-oai-yp2hZnKZd6kDtxtU_W9yCwZIleoJcfs9tVEcdV5jlf1PPtGWlKXCMFBWE2l3","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"facebook-opt-125m-simulated-kserve-workload-svc.llm.svc.cluster.local:8000/*","x-envoy-external-address":"10.133.0.33","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctcDVuYjQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.44~maas-default-gateway-openshift-default-56654dcf7-p5nb4.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.33","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"2bb4e046-595b-4b52-b1a1-31d3a4c9712d"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"2bb4e046-595b-4b52-b1a1-31d3a4c9712d","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":528240636,"seconds":1783364505},"url_path":"/llm/facebook-opt-125m-simulated/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.33:51492","port":51492}}}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2bb4e046-595b-4b52-b1a1-31d3a4c9712d","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2bb4e046-595b-4b52-b1a1-31d3a4c9712d","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2bb4e046-595b-4b52-b1a1-31d3a4c9712d","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2bb4e046-595b-4b52-b1a1-31d3a4c9712d","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2bb4e046-595b-4b52-b1a1-31d3a4c9712d","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2bb4e046-595b-4b52-b1a1-31d3a4c9712d","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2bb4e046-595b-4b52-b1a1-31d3a4c9712d","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2bb4e046-595b-4b52-b1a1-31d3a4c9712d","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","Engineering","Project-Alpha"],"groups_str":"system:authenticated,Engineering,Project-Alpha","keyId":"eb888f9a-1d17-4b28-bee6-e4754f17c8cf","keyName":"e2e-oidc-2c431c6e","selected_subscription":"simulator-subscription","selected_subscription_key":"models-as-a-service/simulator-subscription@llm/facebook-opt-125m-simulated","subscription_error":"","subscription_error_message":"","subscription_info":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true},"userid":"alice_lead"}}
{"level":"info","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2bb4e046-595b-4b52-b1a1-31d3a4c9712d","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2bb4e046-595b-4b52-b1a1-31d3a4c9712d","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f268b936-cd22-4159-9cb9-31ba943b72cd","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:59402","PortSpecifier":{"PortValue":59402}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"f268b936-cd22-4159-9cb9-31ba943b72cd","method":"POST","path":"/llm/facebook-opt-125m-simulated/v1/chat/completions","host":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f268b936-cd22-4159-9cb9-31ba943b72cd","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:59402","PortSpecifier":{"PortValue":59402}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783364505,"nanos":560068601},"http":{"id":"f268b936-cd22-4159-9cb9-31ba943b72cd","method":"POST","headers":{":authority":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com",":method":"POST",":path":"/llm/facebook-opt-125m-simulated/v1/chat/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"f268b936-cd22-4159-9cb9-31ba943b72cd","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-yp2hZnKZd6kDtxtU_W9yCwZIleoJcfs9tVEcdV5jlf1PPtGWlKXCMFBWE2l3"}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"f268b936-cd22-4159-9cb9-31ba943b72cd","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-yp2hZnKZd6kDtxtU_W9yCwZIleoJcfs9tVEcdV5jlf1PPtGWlKXCMFBWE2l3\"}"}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"f268b936-cd22-4159-9cb9-31ba943b72cd","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","Engineering","Project-Alpha"],"keyId":"eb888f9a-1d17-4b28-bee6-e4754f17c8cf","keyName":"e2e-oidc-2c431c6e","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"eb888f9a-1d17-4b28-bee6-e4754f17c8cf","username":"alice_lead","valid":true}}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"f268b936-cd22-4159-9cb9-31ba943b72cd","config":"subscription-info","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"],\"requestedModel\":\"llm/facebook-opt-125m-simulated\",\"requestedSubscription\":\"simulator-subscription\",\"username\":\"alice_lead\"}"}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"f268b936-cd22-4159-9cb9-31ba943b72cd","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true}}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"f268b936-cd22-4159-9cb9-31ba943b72cd","input":{"auth":{"identity":"Bearer **** subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true}}},"context":{"context_extensions":{"host":"311b1be286674fd5684c9ac59b318287dade9769cfe4aeebd8c88e2dc6b72418"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.44:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com",":method":"POST",":path":"/llm/facebook-opt-125m-simulated/v1/chat/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f268b936-cd22-4159-9cb9-31ba943b72cd","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f268b936-cd22-4159-9cb9-31ba943b72cd","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f268b936-cd22-4159-9cb9-31ba943b72cd","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f268b936-cd22-4159-9cb9-31ba943b72cd","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f268b936-cd22-4159-9cb9-31ba943b72cd","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f268b936-cd22-4159-9cb9-31ba943b72cd","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f268b936-cd22-4159-9cb9-31ba943b72cd","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f268b936-cd22-4159-9cb9-31ba943b72cd","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","Engineering","Project-Alpha"],"groups_str":"system:authenticated,Engineering,Project-Alpha","keyId":"eb888f9a-1d17-4b28-bee6-e4754f17c8cf","keyName":"e2e-oidc-2c431c6e","selected_subscription":"simulator-subscription","selected_subscription_key":"models-as-a-service/simulator-subscription@llm/facebook-opt-125m-simulated","subscription_error":"","subscription_error_message":"","subscription_info":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true},"userid":"alice_lead"}}
{"level":"info","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f268b936-cd22-4159-9cb9-31ba943b72cd","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f268b936-cd22-4159-9cb9-31ba943b72cd","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a41868df-dff0-4c31-8eff-1f62ca3d2192","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:59404","PortSpecifier":{"PortValue":59404}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"a41868df-dff0-4c31-8eff-1f62ca3d2192","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a41868df-dff0-4c31-8eff-1f62ca3d2192","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:59404","PortSpecifier":{"PortValue":59404}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783364505,"nanos":665690528},"http":{"id":"a41868df-dff0-4c31-8eff-1f62ca3d2192","method":"POST","headers":{":authority":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"a41868df-dff0-4c31-8eff-1f62ca3d2192","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783364565,"groups":["Engineering","Project-Alpha"],"iat":1783364505,"iss":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:461aab9f-8f2b-3f0d-a858-9263474cce13","preferred_username":"alice_lead","scope":"profile email","sid":"pVBt6NSW5eeSxsqMros7P3gf","sub":"6b999d16-f5e5-4abd-a9f7-94a7ee89c01f","typ":"Bearer"}}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"a41868df-dff0-4c31-8eff-1f62ca3d2192","input":{"auth":{"identity":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783364565,"groups":["Engineering","Project-Alpha"],"iat":1783364505,"iss":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:461aab9f-8f2b-3f0d-a858-9263474cce13","preferred_username":"alice_lead","scope":"profile email","sid":"pVBt6NSW5eeSxsqMros7P3gf","sub":"6b999d16-f5e5-4abd-a9f7-94a7ee89c01f","typ":"Bearer"}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.44:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a41868df-dff0-4c31-8eff-1f62ca3d2192","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a41868df-dff0-4c31-8eff-1f62ca3d2192","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a41868df-dff0-4c31-8eff-1f62ca3d2192","config":{"Name":"oidc-groups-safe","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OPA":{"Rego":"unsafe_group[g] {\n\tg := input.auth.identity.groups[_]\n\tnot regex.match(\"^[A-Za-z0-9:._/-]+$\", g)\n}\n\nallow {\n\tcount(unsafe_group) == 0\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a41868df-dff0-4c31-8eff-1f62ca3d2192","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"a41868df-dff0-4c31-8eff-1f62ca3d2192","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a41868df-dff0-4c31-8eff-1f62ca3d2192","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a41868df-dff0-4c31-8eff-1f62ca3d2192","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"info","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a41868df-dff0-4c31-8eff-1f62ca3d2192","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a41868df-dff0-4c31-8eff-1f62ca3d2192","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e5266ea9-6817-4e88-ae01-2224dc78f710","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:59410","PortSpecifier":{"PortValue":59410}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"e5266ea9-6817-4e88-ae01-2224dc78f710","method":"DELETE","path":"/maas-api/v1/api-keys/beec8b74-4138-47e6-af94-855e8bcec0d1","host":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e5266ea9-6817-4e88-ae01-2224dc78f710","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:59410","PortSpecifier":{"PortValue":59410}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783364505,"nanos":698665938},"http":{"id":"e5266ea9-6817-4e88-ae01-2224dc78f710","method":"DELETE","headers":{":authority":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com",":method":"DELETE",":path":"/maas-api/v1/api-keys/beec8b74-4138-47e6-af94-855e8bcec0d1",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"e5266ea9-6817-4e88-ae01-2224dc78f710","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783364565,"groups":["Engineering","Project-Alpha"],"iat":1783364505,"iss":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:461aab9f-8f2b-3f0d-a858-9263474cce13","preferred_username":"alice_lead","scope":"profile email","sid":"pVBt6NSW5eeSxsqMros7P3gf","sub":"6b999d16-f5e5-4abd-a9f7-94a7ee89c01f","typ":"Bearer"}}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"e5266ea9-6817-4e88-ae01-2224dc78f710","input":{"auth":{"identity":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783364565,"groups":["Engineering","Project-Alpha"],"iat":1783364505,"iss":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:461aab9f-8f2b-3f0d-a858-9263474cce13","preferred_username":"alice_lead","scope":"profile email","sid":"pVBt6NSW5eeSxsqMros7P3gf","sub":"6b999d16-f5e5-4abd-a9f7-94a7ee89c01f","typ":"Bearer"}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.44:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com",":method":"DELETE",":path":"/maas-api/v1/api-keys/beec8b74-4138-47e6-af94-855e8bcec0d1",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e5266ea9-6817-4e88-ae01-2224dc78f710","config":{"Name":"oidc-groups-safe","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OPA":{"Rego":"unsafe_group[g] {\n\tg := input.auth.identity.groups[_]\n\tnot regex.match(\"^[A-Za-z0-9:._/-]+$\", g)\n}\n\nallow {\n\tcount(unsafe_group) == 0\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e5266ea9-6817-4e88-ae01-2224dc78f710","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e5266ea9-6817-4e88-ae01-2224dc78f710","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e5266ea9-6817-4e88-ae01-2224dc78f710","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"e5266ea9-6817-4e88-ae01-2224dc78f710","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e5266ea9-6817-4e88-ae01-2224dc78f710","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e5266ea9-6817-4e88-ae01-2224dc78f710","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"info","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e5266ea9-6817-4e88-ae01-2224dc78f710","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e5266ea9-6817-4e88-ae01-2224dc78f710","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"95087a46-a395-4061-beb8-d6d397ecc92c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:59414","PortSpecifier":{"PortValue":59414}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"95087a46-a395-4061-beb8-d6d397ecc92c","method":"GET","path":"/maas-api/v1/models","host":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"95087a46-a395-4061-beb8-d6d397ecc92c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:59414","PortSpecifier":{"PortValue":59414}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783364505,"nanos":734500688},"http":{"id":"95087a46-a395-4061-beb8-d6d397ecc92c","method":"GET","headers":{":authority":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"95087a46-a395-4061-beb8-d6d397ecc92c","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-sAKNFwQuwkTieGrM_U4uX7JCaSD17rz3aXFloCXen7quY6sAsTyj0Pue23Ub"}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"95087a46-a395-4061-beb8-d6d397ecc92c","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-sAKNFwQuwkTieGrM_U4uX7JCaSD17rz3aXFloCXen7quY6sAsTyj0Pue23Ub\"}"}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"95087a46-a395-4061-beb8-d6d397ecc92c","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"reason":"key revoked or expired","tenant":"","valid":false}}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"95087a46-a395-4061-beb8-d6d397ecc92c","input":{"auth":{"identity":"Bearer **** revoked or expired","tenant":"","valid":false}}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.44:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"95087a46-a395-4061-beb8-d6d397ecc92c","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access denied","request id":"95087a46-a395-4061-beb8-d6d397ecc92c","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"reason":"Unauthorized"}
{"level":"info","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"95087a46-a395-4061-beb8-d6d397ecc92c","authorized":false,"response":"PERMISSION_DENIED","object":{"code":7,"status":403,"message":"Unauthorized"}}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"95087a46-a395-4061-beb8-d6d397ecc92c","authorized":false,"response":"PERMISSION_DENIED","object":{"code":7,"status":403,"message":"Unauthorized","headers":[{"content-type":"text/plain"},{"x-ext-auth-reason":""}]}}
{"level":"info","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0d584e02-c8fc-4090-86b2-65dc39cf5fe5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:59418","PortSpecifier":{"PortValue":59418}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"0d584e02-c8fc-4090-86b2-65dc39cf5fe5","method":"GET","path":"/maas-api/v1/models","host":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0d584e02-c8fc-4090-86b2-65dc39cf5fe5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:59418","PortSpecifier":{"PortValue":59418}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783364505,"nanos":766100467},"http":{"id":"0d584e02-c8fc-4090-86b2-65dc39cf5fe5","method":"GET","headers":{":authority":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"0d584e02-c8fc-4090-86b2-65dc39cf5fe5","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-sAKNFwQuwkTieGrM_U4uX7JCaSD17rz3aXFloCXen7quY6sAsTyj0Pue23Ub"}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"0d584e02-c8fc-4090-86b2-65dc39cf5fe5","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-sAKNFwQuwkTieGrM_U4uX7JCaSD17rz3aXFloCXen7quY6sAsTyj0Pue23Ub\"}"}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"0d584e02-c8fc-4090-86b2-65dc39cf5fe5","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"reason":"key revoked or expired","tenant":"","valid":false}}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"0d584e02-c8fc-4090-86b2-65dc39cf5fe5","input":{"auth":{"identity":"Bearer **** revoked or expired","tenant":"","valid":false}}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.44:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0d584e02-c8fc-4090-86b2-65dc39cf5fe5","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access denied","request id":"0d584e02-c8fc-4090-86b2-65dc39cf5fe5","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"reason":"Unauthorized"}
{"level":"info","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0d584e02-c8fc-4090-86b2-65dc39cf5fe5","authorized":false,"response":"PERMISSION_DENIED","object":{"code":7,"status":403,"message":"Unauthorized"}}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0d584e02-c8fc-4090-86b2-65dc39cf5fe5","authorized":false,"response":"PERMISSION_DENIED","object":{"code":7,"status":403,"message":"Unauthorized","headers":[{"content-type":"text/plain"},{"x-ext-auth-reason":""}]}}
{"level":"info","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"56327328-2ed6-419a-adfe-3c710ad88bf2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:59430","PortSpecifier":{"PortValue":59430}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"56327328-2ed6-419a-adfe-3c710ad88bf2","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"56327328-2ed6-419a-adfe-3c710ad88bf2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:59430","PortSpecifier":{"PortValue":59430}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783364505,"nanos":892990364},"http":{"id":"56327328-2ed6-419a-adfe-3c710ad88bf2","method":"POST","headers":{":authority":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"56327328-2ed6-419a-adfe-3c710ad88bf2","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"56327328-2ed6-419a-adfe-3c710ad88bf2","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"56327328-2ed6-419a-adfe-3c710ad88bf2","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"not authenticated"}
{"level":"info","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"56327328-2ed6-419a-adfe-3c710ad88bf2","authorized":false,"response":"UNAUTHENTICATED","object":{"code":16,"status":401,"message":"Authentication required"}}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"56327328-2ed6-419a-adfe-3c710ad88bf2","authorized":false,"response":"UNAUTHENTICATED","object":{"code":16,"status":401,"message":"Authentication required","headers":[{"WWW-Authenticate":"request.headers.authorization realm=\"api-keys\""},{"WWW-Authenticate":"Bearer **** realm=\"openshift-identities\""}]}}
{"level":"info","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"df8d017a-82a2-4a07-94b3-1073ddb1501c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:59444","PortSpecifier":{"PortValue":59444}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"df8d017a-82a2-4a07-94b3-1073ddb1501c","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"df8d017a-82a2-4a07-94b3-1073ddb1501c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:59444","PortSpecifier":{"PortValue":59444}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783364506,"nanos":78194978},"http":{"id":"df8d017a-82a2-4a07-94b3-1073ddb1501c","method":"POST","headers":{":authority":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"df8d017a-82a2-4a07-94b3-1073ddb1501c","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783364565,"groups":["Engineering","Project-Alpha"],"iat":1783364505,"iss":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:efa45c5f-af5c-7fbc-a19b-9beaee492778","preferred_username":"alice_lead","scope":"profile email","sid":"a-MuI96cA5gmlf7Umin9SBgN","sub":"6b999d16-f5e5-4abd-a9f7-94a7ee89c01f","typ":"Bearer"}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"df8d017a-82a2-4a07-94b3-1073ddb1501c","input":{"auth":{"identity":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783364565,"groups":["Engineering","Project-Alpha"],"iat":1783364505,"iss":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:efa45c5f-af5c-7fbc-a19b-9beaee492778","preferred_username":"alice_lead","scope":"profile email","sid":"a-MuI96cA5gmlf7Umin9SBgN","sub":"6b999d16-f5e5-4abd-a9f7-94a7ee89c01f","typ":"Bearer"}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.44:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"df8d017a-82a2-4a07-94b3-1073ddb1501c","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"df8d017a-82a2-4a07-94b3-1073ddb1501c","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"df8d017a-82a2-4a07-94b3-1073ddb1501c","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"df8d017a-82a2-4a07-94b3-1073ddb1501c","config":{"Name":"oidc-groups-safe","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OPA":{"Rego":"unsafe_group[g] {\n\tg := input.auth.identity.groups[_]\n\tnot regex.match(\"^[A-Za-z0-9:._/-]+$\", g)\n}\n\nallow {\n\tcount(unsafe_group) == 0\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"df8d017a-82a2-4a07-94b3-1073ddb1501c","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"df8d017a-82a2-4a07-94b3-1073ddb1501c","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"df8d017a-82a2-4a07-94b3-1073ddb1501c","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"info","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"df8d017a-82a2-4a07-94b3-1073ddb1501c","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"df8d017a-82a2-4a07-94b3-1073ddb1501c","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9b3236a9-4d6d-42d9-be4f-67f2d3767f16","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:59450","PortSpecifier":{"PortValue":59450}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"9b3236a9-4d6d-42d9-be4f-67f2d3767f16","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9b3236a9-4d6d-42d9-be4f-67f2d3767f16","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:59450","PortSpecifier":{"PortValue":59450}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783364506,"nanos":109190509},"http":{"id":"9b3236a9-4d6d-42d9-be4f-67f2d3767f16","method":"POST","headers":{":authority":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"9b3236a9-4d6d-42d9-be4f-67f2d3767f16","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783364566,"groups":["Site-Reliability"],"iat":1783364506,"iss":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:3679c667-5b45-d414-b109-75c6c0348854","preferred_username":"bob_sre","scope":"profile email","sid":"gsLpknyalo-UJ18qPIQtnIor","sub":"fdf43355-8302-4a9a-9bcd-e7f0d0a3a147","typ":"Bearer"}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"9b3236a9-4d6d-42d9-be4f-67f2d3767f16","input":{"auth":{"identity":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783364566,"groups":["Site-Reliability"],"iat":1783364506,"iss":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:3679c667-5b45-d414-b109-75c6c0348854","preferred_username":"bob_sre","scope":"profile email","sid":"gsLpknyalo-UJ18qPIQtnIor","sub":"fdf43355-8302-4a9a-9bcd-e7f0d0a3a147","typ":"Bearer"}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.44:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9b3236a9-4d6d-42d9-be4f-67f2d3767f16","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9b3236a9-4d6d-42d9-be4f-67f2d3767f16","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9b3236a9-4d6d-42d9-be4f-67f2d3767f16","config":{"Name":"oidc-groups-safe","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OPA":{"Rego":"unsafe_group[g] {\n\tg := input.auth.identity.groups[_]\n\tnot regex.match(\"^[A-Za-z0-9:._/-]+$\", g)\n}\n\nallow {\n\tcount(unsafe_group) == 0\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9b3236a9-4d6d-42d9-be4f-67f2d3767f16","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"9b3236a9-4d6d-42d9-be4f-67f2d3767f16","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9b3236a9-4d6d-42d9-be4f-67f2d3767f16","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"bob_sre"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9b3236a9-4d6d-42d9-be4f-67f2d3767f16","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Site-Reliability\"]"}
{"level":"info","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9b3236a9-4d6d-42d9-be4f-67f2d3767f16","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9b3236a9-4d6d-42d9-be4f-67f2d3767f16","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"110ad181-56fd-4f0d-9f45-8b573b1dca5d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:59458","PortSpecifier":{"PortValue":59458}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"110ad181-56fd-4f0d-9f45-8b573b1dca5d","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"110ad181-56fd-4f0d-9f45-8b573b1dca5d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:59458","PortSpecifier":{"PortValue":59458}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783364506,"nanos":196720187},"http":{"id":"110ad181-56fd-4f0d-9f45-8b573b1dca5d","method":"POST","headers":{":authority":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"110ad181-56fd-4f0d-9f45-8b573b1dca5d","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783364566,"groups":["Engineering","Project-Alpha"],"iat":1783364506,"iss":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:106d5f97-8c72-cb39-d458-b9ed0fde79ce","preferred_username":"alice_lead","scope":"profile email","sid":"f-IBxNApnOYFzVL9L6QmRNyO","sub":"6b999d16-f5e5-4abd-a9f7-94a7ee89c01f","typ":"Bearer"}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"110ad181-56fd-4f0d-9f45-8b573b1dca5d","input":{"auth":{"identity":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783364566,"groups":["Engineering","Project-Alpha"],"iat":1783364506,"iss":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:106d5f97-8c72-cb39-d458-b9ed0fde79ce","preferred_username":"alice_lead","scope":"profile email","sid":"f-IBxNApnOYFzVL9L6QmRNyO","sub":"6b999d16-f5e5-4abd-a9f7-94a7ee89c01f","typ":"Bearer"}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.44:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"110ad181-56fd-4f0d-9f45-8b573b1dca5d","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"110ad181-56fd-4f0d-9f45-8b573b1dca5d","config":{"Name":"oidc-groups-safe","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OPA":{"Rego":"unsafe_group[g] {\n\tg := input.auth.identity.groups[_]\n\tnot regex.match(\"^[A-Za-z0-9:._/-]+$\", g)\n}\n\nallow {\n\tcount(unsafe_group) == 0\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"110ad181-56fd-4f0d-9f45-8b573b1dca5d","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"110ad181-56fd-4f0d-9f45-8b573b1dca5d","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"110ad181-56fd-4f0d-9f45-8b573b1dca5d","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"110ad181-56fd-4f0d-9f45-8b573b1dca5d","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"110ad181-56fd-4f0d-9f45-8b573b1dca5d","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"info","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"110ad181-56fd-4f0d-9f45-8b573b1dca5d","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"110ad181-56fd-4f0d-9f45-8b573b1dca5d","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5a01086f-eb15-489a-a42e-7c8887da78ca","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:59466","PortSpecifier":{"PortValue":59466}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"5a01086f-eb15-489a-a42e-7c8887da78ca","method":"DELETE","path":"/maas-api/v1/api-keys/c66a0032-2497-471d-bd41-140c6d921b9d","host":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5a01086f-eb15-489a-a42e-7c8887da78ca","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:59466","PortSpecifier":{"PortValue":59466}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783364506,"nanos":226015772},"http":{"id":"5a01086f-eb15-489a-a42e-7c8887da78ca","method":"DELETE","headers":{":authority":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com",":method":"DELETE",":path":"/maas-api/v1/api-keys/c66a0032-2497-471d-bd41-140c6d921b9d",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"5a01086f-eb15-489a-a42e-7c8887da78ca","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783364566,"groups":["Engineering","Project-Alpha"],"iat":1783364506,"iss":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:106d5f97-8c72-cb39-d458-b9ed0fde79ce","preferred_username":"alice_lead","scope":"profile email","sid":"f-IBxNApnOYFzVL9L6QmRNyO","sub":"6b999d16-f5e5-4abd-a9f7-94a7ee89c01f","typ":"Bearer"}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"5a01086f-eb15-489a-a42e-7c8887da78ca","input":{"auth":{"identity":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783364566,"groups":["Engineering","Project-Alpha"],"iat":1783364506,"iss":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:106d5f97-8c72-cb39-d458-b9ed0fde79ce","preferred_username":"alice_lead","scope":"profile email","sid":"f-IBxNApnOYFzVL9L6QmRNyO","sub":"6b999d16-f5e5-4abd-a9f7-94a7ee89c01f","typ":"Bearer"}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.44:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com",":method":"DELETE",":path":"/maas-api/v1/api-keys/c66a0032-2497-471d-bd41-140c6d921b9d",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5a01086f-eb15-489a-a42e-7c8887da78ca","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5a01086f-eb15-489a-a42e-7c8887da78ca","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5a01086f-eb15-489a-a42e-7c8887da78ca","config":{"Name":"oidc-groups-safe","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OPA":{"Rego":"unsafe_group[g] {\n\tg := input.auth.identity.groups[_]\n\tnot regex.match(\"^[A-Za-z0-9:._/-]+$\", g)\n}\n\nallow {\n\tcount(unsafe_group) == 0\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5a01086f-eb15-489a-a42e-7c8887da78ca","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"5a01086f-eb15-489a-a42e-7c8887da78ca","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5a01086f-eb15-489a-a42e-7c8887da78ca","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5a01086f-eb15-489a-a42e-7c8887da78ca","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"info","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5a01086f-eb15-489a-a42e-7c8887da78ca","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5a01086f-eb15-489a-a42e-7c8887da78ca","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"dac73979-b5a9-4003-8230-5b2e3d832893","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:59470","PortSpecifier":{"PortValue":59470}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"dac73979-b5a9-4003-8230-5b2e3d832893","method":"DELETE","path":"/maas-api/v1/api-keys/c66a0032-2497-471d-bd41-140c6d921b9d","host":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"dac73979-b5a9-4003-8230-5b2e3d832893","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:59470","PortSpecifier":{"PortValue":59470}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783364506,"nanos":261095979},"http":{"id":"dac73979-b5a9-4003-8230-5b2e3d832893","method":"DELETE","headers":{":authority":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com",":method":"DELETE",":path":"/maas-api/v1/api-keys/c66a0032-2497-471d-bd41-140c6d921b9d",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"dac73979-b5a9-4003-8230-5b2e3d832893","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783364566,"groups":["Engineering","Project-Alpha"],"iat":1783364506,"iss":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:106d5f97-8c72-cb39-d458-b9ed0fde79ce","preferred_username":"alice_lead","scope":"profile email","sid":"f-IBxNApnOYFzVL9L6QmRNyO","sub":"6b999d16-f5e5-4abd-a9f7-94a7ee89c01f","typ":"Bearer"}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"dac73979-b5a9-4003-8230-5b2e3d832893","input":{"auth":{"identity":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783364566,"groups":["Engineering","Project-Alpha"],"iat":1783364506,"iss":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:106d5f97-8c72-cb39-d458-b9ed0fde79ce","preferred_username":"alice_lead","scope":"profile email","sid":"f-IBxNApnOYFzVL9L6QmRNyO","sub":"6b999d16-f5e5-4abd-a9f7-94a7ee89c01f","typ":"Bearer"}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.44:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com",":method":"DELETE",":path":"/maas-api/v1/api-keys/c66a0032-2497-471d-bd41-140c6d921b9d",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"dac73979-b5a9-4003-8230-5b2e3d832893","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"dac73979-b5a9-4003-8230-5b2e3d832893","config":{"Name":"oidc-groups-safe","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OPA":{"Rego":"unsafe_group[g] {\n\tg := input.auth.identity.groups[_]\n\tnot regex.match(\"^[A-Za-z0-9:._/-]+$\", g)\n}\n\nallow {\n\tcount(unsafe_group) == 0\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"dac73979-b5a9-4003-8230-5b2e3d832893","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"dac73979-b5a9-4003-8230-5b2e3d832893","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"dac73979-b5a9-4003-8230-5b2e3d832893","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"dac73979-b5a9-4003-8230-5b2e3d832893","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"dac73979-b5a9-4003-8230-5b2e3d832893","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"info","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"dac73979-b5a9-4003-8230-5b2e3d832893","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"dac73979-b5a9-4003-8230-5b2e3d832893","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7f077843-063b-43a5-9474-b361ae966150","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:59484","PortSpecifier":{"PortValue":59484}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"7f077843-063b-43a5-9474-b361ae966150","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7f077843-063b-43a5-9474-b361ae966150","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:59484","PortSpecifier":{"PortValue":59484}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783364506,"nanos":355049385},"http":{"id":"7f077843-063b-43a5-9474-b361ae966150","method":"POST","headers":{":authority":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"7f077843-063b-43a5-9474-b361ae966150","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783364566,"groups":["Engineering","Project-Alpha"],"iat":1783364506,"iss":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:d58bf77a-e8e4-1f6b-f724-1a6f4b1768e4","preferred_username":"alice_lead","scope":"profile email","sid":"j8sZ6gc7-sqpgE4gvoyjZ6-M","sub":"6b999d16-f5e5-4abd-a9f7-94a7ee89c01f","typ":"Bearer"}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"7f077843-063b-43a5-9474-b361ae966150","input":{"auth":{"identity":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783364566,"groups":["Engineering","Project-Alpha"],"iat":1783364506,"iss":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:d58bf77a-e8e4-1f6b-f724-1a6f4b1768e4","preferred_username":"alice_lead","scope":"profile email","sid":"j8sZ6gc7-sqpgE4gvoyjZ6-M","sub":"6b999d16-f5e5-4abd-a9f7-94a7ee89c01f","typ":"Bearer"}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.44:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7f077843-063b-43a5-9474-b361ae966150","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7f077843-063b-43a5-9474-b361ae966150","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7f077843-063b-43a5-9474-b361ae966150","config":{"Name":"oidc-groups-safe","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OPA":{"Rego":"unsafe_group[g] {\n\tg := input.auth.identity.groups[_]\n\tnot regex.match(\"^[A-Za-z0-9:._/-]+$\", g)\n}\n\nallow {\n\tcount(unsafe_group) == 0\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7f077843-063b-43a5-9474-b361ae966150","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"7f077843-063b-43a5-9474-b361ae966150","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7f077843-063b-43a5-9474-b361ae966150","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7f077843-063b-43a5-9474-b361ae966150","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"info","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7f077843-063b-43a5-9474-b361ae966150","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7f077843-063b-43a5-9474-b361ae966150","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"414c489f-0eb5-463e-9051-8fdc2705e239","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:59496","PortSpecifier":{"PortValue":59496}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"414c489f-0eb5-463e-9051-8fdc2705e239","method":"GET","path":"/maas-api/v1/models","host":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"414c489f-0eb5-463e-9051-8fdc2705e239","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:59496","PortSpecifier":{"PortValue":59496}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783364506,"nanos":394992642},"http":{"id":"414c489f-0eb5-463e-9051-8fdc2705e239","method":"GET","headers":{":authority":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"414c489f-0eb5-463e-9051-8fdc2705e239","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1PE0DNNBE7bu43XkM_tkU9rxgBwUuGfvMUWeEnPeIqyAEsjo4gLPv6WYzCpUD"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"414c489f-0eb5-463e-9051-8fdc2705e239","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1PE0DNNBE7bu43XkM_tkU9rxgBwUuGfvMUWeEnPeIqyAEsjo4gLPv6WYzCpUD\"}"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"414c489f-0eb5-463e-9051-8fdc2705e239","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","Engineering","Project-Alpha"],"keyId":"94351f72-1a80-4716-92f6-2e2db1ff093c","keyName":"e2e-oidc-4ccbfda1","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"94351f72-1a80-4716-92f6-2e2db1ff093c","username":"alice_lead","valid":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"414c489f-0eb5-463e-9051-8fdc2705e239","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"414c489f-0eb5-463e-9051-8fdc2705e239","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"414c489f-0eb5-463e-9051-8fdc2705e239","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"414c489f-0eb5-463e-9051-8fdc2705e239","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"414c489f-0eb5-463e-9051-8fdc2705e239","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"414c489f-0eb5-463e-9051-8fdc2705e239","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"414c489f-0eb5-463e-9051-8fdc2705e239","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"414c489f-0eb5-463e-9051-8fdc2705e239","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"414c489f-0eb5-463e-9051-8fdc2705e239","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"414c489f-0eb5-463e-9051-8fdc2705e239","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"dcaf3ba0-ff59-4f46-84aa-8fd62afed374","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.33:51492","PortSpecifier":{"PortValue":51492}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"dcaf3ba0-ff59-4f46-84aa-8fd62afed374","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"dcaf3ba0-ff59-4f46-84aa-8fd62afed374","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.33:51492","PortSpecifier":{"PortValue":51492}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783364506,"nanos":404003221},"http":{"id":"dcaf3ba0-ff59-4f46-84aa-8fd62afed374","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"dcaf3ba0-ff59-4f46-84aa-8fd62afed374","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1PE0DNNBE7bu43XkM_tkU9rxgBwUuGfvMUWeEnPeIqyAEsjo4gLPv6WYzCpUD"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"dcaf3ba0-ff59-4f46-84aa-8fd62afed374","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1PE0DNNBE7bu43XkM_tkU9rxgBwUuGfvMUWeEnPeIqyAEsjo4gLPv6WYzCpUD\"}"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"dcaf3ba0-ff59-4f46-84aa-8fd62afed374","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","Engineering","Project-Alpha"],"keyId":"94351f72-1a80-4716-92f6-2e2db1ff093c","keyName":"e2e-oidc-4ccbfda1","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"94351f72-1a80-4716-92f6-2e2db1ff093c","username":"alice_lead","valid":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"dcaf3ba0-ff59-4f46-84aa-8fd62afed374","config":"subscription-info","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"],\"requestedModel\":\"llm/facebook-opt-125m-simulated\",\"requestedSubscription\":\"simulator-subscription\",\"username\":\"alice_lead\"}"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"dcaf3ba0-ff59-4f46-84aa-8fd62afed374","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"dcaf3ba0-ff59-4f46-84aa-8fd62afed374","input":{"auth":{"identity":"Bearer **** subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true}}},"context":{"context_extensions":{"host":"4375a0165d777c3dbcac3b90772aafb3ba82b742e01878423b9fb1e122337433"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.44:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** sk-oai-1PE0DNNBE7bu43XkM_tkU9rxgBwUuGfvMUWeEnPeIqyAEsjo4gLPv6WYzCpUD","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"facebook-opt-125m-simulated-kserve-workload-svc.llm.svc.cluster.local:8000/*","x-envoy-external-address":"10.133.0.33","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctcDVuYjQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.44~maas-default-gateway-openshift-default-56654dcf7-p5nb4.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.33","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"dcaf3ba0-ff59-4f46-84aa-8fd62afed374"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"dcaf3ba0-ff59-4f46-84aa-8fd62afed374","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":404003221,"seconds":1783364506},"url_path":"/llm/facebook-opt-125m-simulated/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.33:51492","port":51492}}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"dcaf3ba0-ff59-4f46-84aa-8fd62afed374","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"dcaf3ba0-ff59-4f46-84aa-8fd62afed374","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"dcaf3ba0-ff59-4f46-84aa-8fd62afed374","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"dcaf3ba0-ff59-4f46-84aa-8fd62afed374","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"dcaf3ba0-ff59-4f46-84aa-8fd62afed374","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"dcaf3ba0-ff59-4f46-84aa-8fd62afed374","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"dcaf3ba0-ff59-4f46-84aa-8fd62afed374","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"dcaf3ba0-ff59-4f46-84aa-8fd62afed374","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","Engineering","Project-Alpha"],"groups_str":"system:authenticated,Engineering,Project-Alpha","keyId":"94351f72-1a80-4716-92f6-2e2db1ff093c","keyName":"e2e-oidc-4ccbfda1","selected_subscription":"simulator-subscription","selected_subscription_key":"models-as-a-service/simulator-subscription@llm/facebook-opt-125m-simulated","subscription_error":"","subscription_error_message":"","subscription_info":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true},"userid":"alice_lead"}}
{"level":"info","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"dcaf3ba0-ff59-4f46-84aa-8fd62afed374","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"dcaf3ba0-ff59-4f46-84aa-8fd62afed374","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"03126a7c-9f2f-4704-a3ff-3b9a67e38a06","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:59506","PortSpecifier":{"PortValue":59506}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"03126a7c-9f2f-4704-a3ff-3b9a67e38a06","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"03126a7c-9f2f-4704-a3ff-3b9a67e38a06","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:59506","PortSpecifier":{"PortValue":59506}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783364506,"nanos":500830719},"http":{"id":"03126a7c-9f2f-4704-a3ff-3b9a67e38a06","method":"POST","headers":{":authority":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"03126a7c-9f2f-4704-a3ff-3b9a67e38a06","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783364566,"groups":["Engineering","Project-Alpha"],"iat":1783364506,"iss":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:db0baa81-e66c-316e-74ad-a33b77895df9","preferred_username":"alice_lead","scope":"profile email","sid":"cKK5JdQims4C8ggmnYzYCwZo","sub":"6b999d16-f5e5-4abd-a9f7-94a7ee89c01f","typ":"Bearer"}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"03126a7c-9f2f-4704-a3ff-3b9a67e38a06","input":{"auth":{"identity":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783364566,"groups":["Engineering","Project-Alpha"],"iat":1783364506,"iss":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:db0baa81-e66c-316e-74ad-a33b77895df9","preferred_username":"alice_lead","scope":"profile email","sid":"cKK5JdQims4C8ggmnYzYCwZo","sub":"6b999d16-f5e5-4abd-a9f7-94a7ee89c01f","typ":"Bearer"}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.44:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"03126a7c-9f2f-4704-a3ff-3b9a67e38a06","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"03126a7c-9f2f-4704-a3ff-3b9a67e38a06","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"03126a7c-9f2f-4704-a3ff-3b9a67e38a06","config":{"Name":"oidc-groups-safe","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OPA":{"Rego":"unsafe_group[g] {\n\tg := input.auth.identity.groups[_]\n\tnot regex.match(\"^[A-Za-z0-9:._/-]+$\", g)\n}\n\nallow {\n\tcount(unsafe_group) == 0\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"03126a7c-9f2f-4704-a3ff-3b9a67e38a06","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"03126a7c-9f2f-4704-a3ff-3b9a67e38a06","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"03126a7c-9f2f-4704-a3ff-3b9a67e38a06","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"03126a7c-9f2f-4704-a3ff-3b9a67e38a06","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"info","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"03126a7c-9f2f-4704-a3ff-3b9a67e38a06","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"03126a7c-9f2f-4704-a3ff-3b9a67e38a06","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"df49a58f-ffe7-4512-a7e6-46fc9d3c8559","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:59516","PortSpecifier":{"PortValue":59516}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"df49a58f-ffe7-4512-a7e6-46fc9d3c8559","method":"GET","path":"/maas-api/v1/models","host":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"df49a58f-ffe7-4512-a7e6-46fc9d3c8559","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:59516","PortSpecifier":{"PortValue":59516}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783364506,"nanos":531004154},"http":{"id":"df49a58f-ffe7-4512-a7e6-46fc9d3c8559","method":"GET","headers":{":authority":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"df49a58f-ffe7-4512-a7e6-46fc9d3c8559","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-KXW8JQUUb3HIFkj8_9uCGaDlrqdrqH5oWetS2tjMAEsCl6ggSugTuD6ViOg8"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"df49a58f-ffe7-4512-a7e6-46fc9d3c8559","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-KXW8JQUUb3HIFkj8_9uCGaDlrqdrqH5oWetS2tjMAEsCl6ggSugTuD6ViOg8\"}"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"df49a58f-ffe7-4512-a7e6-46fc9d3c8559","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","Engineering","Project-Alpha"],"keyId":"989d7ed0-d53c-4c9a-bd51-52b7da27ba9e","keyName":"e2e-oidc-b13e2aaa","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"989d7ed0-d53c-4c9a-bd51-52b7da27ba9e","username":"alice_lead","valid":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"df49a58f-ffe7-4512-a7e6-46fc9d3c8559","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"df49a58f-ffe7-4512-a7e6-46fc9d3c8559","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"df49a58f-ffe7-4512-a7e6-46fc9d3c8559","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"df49a58f-ffe7-4512-a7e6-46fc9d3c8559","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"df49a58f-ffe7-4512-a7e6-46fc9d3c8559","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"df49a58f-ffe7-4512-a7e6-46fc9d3c8559","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"df49a58f-ffe7-4512-a7e6-46fc9d3c8559","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"df49a58f-ffe7-4512-a7e6-46fc9d3c8559","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"info","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"df49a58f-ffe7-4512-a7e6-46fc9d3c8559","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"df49a58f-ffe7-4512-a7e6-46fc9d3c8559","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8f1208d3-f40f-4638-b04b-bb46b7538562","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:59526","PortSpecifier":{"PortValue":59526}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"8f1208d3-f40f-4638-b04b-bb46b7538562","method":"GET","path":"/maas-api/v1/models","host":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8f1208d3-f40f-4638-b04b-bb46b7538562","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:59526","PortSpecifier":{"PortValue":59526}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783364506,"nanos":556798220},"http":{"id":"8f1208d3-f40f-4638-b04b-bb46b7538562","method":"GET","headers":{":authority":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"8f1208d3-f40f-4638-b04b-bb46b7538562","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-KXW8JQUUb3HIFkj8_9uCGaDlrqdrqH5oWetS2tjMAEsCl6ggSugTuD6ViOg8"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"8f1208d3-f40f-4638-b04b-bb46b7538562","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-KXW8JQUUb3HIFkj8_9uCGaDlrqdrqH5oWetS2tjMAEsCl6ggSugTuD6ViOg8\"}"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"8f1208d3-f40f-4638-b04b-bb46b7538562","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","Engineering","Project-Alpha"],"keyId":"989d7ed0-d53c-4c9a-bd51-52b7da27ba9e","keyName":"e2e-oidc-b13e2aaa","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"989d7ed0-d53c-4c9a-bd51-52b7da27ba9e","username":"alice_lead","valid":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"8f1208d3-f40f-4638-b04b-bb46b7538562","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8f1208d3-f40f-4638-b04b-bb46b7538562","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8f1208d3-f40f-4638-b04b-bb46b7538562","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8f1208d3-f40f-4638-b04b-bb46b7538562","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8f1208d3-f40f-4638-b04b-bb46b7538562","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"8f1208d3-f40f-4638-b04b-bb46b7538562","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8f1208d3-f40f-4638-b04b-bb46b7538562","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8f1208d3-f40f-4638-b04b-bb46b7538562","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"info","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8f1208d3-f40f-4638-b04b-bb46b7538562","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8f1208d3-f40f-4638-b04b-bb46b7538562","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a60db3a2-9e2e-415c-a207-fb3440eafff7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.33:51492","PortSpecifier":{"PortValue":51492}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"a60db3a2-9e2e-415c-a207-fb3440eafff7","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a60db3a2-9e2e-415c-a207-fb3440eafff7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.33:51492","PortSpecifier":{"PortValue":51492}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783364506,"nanos":564778901},"http":{"id":"a60db3a2-9e2e-415c-a207-fb3440eafff7","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"a60db3a2-9e2e-415c-a207-fb3440eafff7","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-KXW8JQUUb3HIFkj8_9uCGaDlrqdrqH5oWetS2tjMAEsCl6ggSugTuD6ViOg8"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a60db3a2-9e2e-415c-a207-fb3440eafff7","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-KXW8JQUUb3HIFkj8_9uCGaDlrqdrqH5oWetS2tjMAEsCl6ggSugTuD6ViOg8\"}"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a60db3a2-9e2e-415c-a207-fb3440eafff7","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","Engineering","Project-Alpha"],"keyId":"989d7ed0-d53c-4c9a-bd51-52b7da27ba9e","keyName":"e2e-oidc-b13e2aaa","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"989d7ed0-d53c-4c9a-bd51-52b7da27ba9e","username":"alice_lead","valid":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a60db3a2-9e2e-415c-a207-fb3440eafff7","config":"subscription-info","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"],\"requestedModel\":\"llm/facebook-opt-125m-simulated\",\"requestedSubscription\":\"simulator-subscription\",\"username\":\"alice_lead\"}"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a60db3a2-9e2e-415c-a207-fb3440eafff7","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"a60db3a2-9e2e-415c-a207-fb3440eafff7","input":{"auth":{"identity":"Bearer **** subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true}}},"context":{"context_extensions":{"host":"4375a0165d777c3dbcac3b90772aafb3ba82b742e01878423b9fb1e122337433"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.44:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** sk-oai-KXW8JQUUb3HIFkj8_9uCGaDlrqdrqH5oWetS2tjMAEsCl6ggSugTuD6ViOg8","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"facebook-opt-125m-simulated-kserve-workload-svc.llm.svc.cluster.local:8000/*","x-envoy-external-address":"10.133.0.33","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctcDVuYjQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.44~maas-default-gateway-openshift-default-56654dcf7-p5nb4.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.33","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"a60db3a2-9e2e-415c-a207-fb3440eafff7"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"a60db3a2-9e2e-415c-a207-fb3440eafff7","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":564778901,"seconds":1783364506},"url_path":"/llm/facebook-opt-125m-simulated/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.33:51492","port":51492}}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a60db3a2-9e2e-415c-a207-fb3440eafff7","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a60db3a2-9e2e-415c-a207-fb3440eafff7","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a60db3a2-9e2e-415c-a207-fb3440eafff7","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a60db3a2-9e2e-415c-a207-fb3440eafff7","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a60db3a2-9e2e-415c-a207-fb3440eafff7","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a60db3a2-9e2e-415c-a207-fb3440eafff7","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a60db3a2-9e2e-415c-a207-fb3440eafff7","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a60db3a2-9e2e-415c-a207-fb3440eafff7","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","Engineering","Project-Alpha"],"groups_str":"system:authenticated,Engineering,Project-Alpha","keyId":"989d7ed0-d53c-4c9a-bd51-52b7da27ba9e","keyName":"e2e-oidc-b13e2aaa","selected_subscription":"simulator-subscription","selected_subscription_key":"models-as-a-service/simulator-subscription@llm/facebook-opt-125m-simulated","subscription_error":"","subscription_error_message":"","subscription_info":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true},"userid":"alice_lead"}}
{"level":"info","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a60db3a2-9e2e-415c-a207-fb3440eafff7","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a60db3a2-9e2e-415c-a207-fb3440eafff7","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"39c5ee53-718e-4589-aa6e-2080ac249a60","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:59538","PortSpecifier":{"PortValue":59538}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"39c5ee53-718e-4589-aa6e-2080ac249a60","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"39c5ee53-718e-4589-aa6e-2080ac249a60","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:59538","PortSpecifier":{"PortValue":59538}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783364506,"nanos":684157799},"http":{"id":"39c5ee53-718e-4589-aa6e-2080ac249a60","method":"POST","headers":{":authority":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"39c5ee53-718e-4589-aa6e-2080ac249a60","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783364566,"groups":["Engineering","Project-Alpha"],"iat":1783364506,"iss":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:e0623b83-328c-76b9-6d86-02ac6592b8a4","preferred_username":"alice_lead","scope":"profile email","sid":"IdJwN7IfGvJIU8Vk0FljEAgg","sub":"6b999d16-f5e5-4abd-a9f7-94a7ee89c01f","typ":"Bearer"}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"39c5ee53-718e-4589-aa6e-2080ac249a60","input":{"auth":{"identity":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783364566,"groups":["Engineering","Project-Alpha"],"iat":1783364506,"iss":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:e0623b83-328c-76b9-6d86-02ac6592b8a4","preferred_username":"alice_lead","scope":"profile email","sid":"IdJwN7IfGvJIU8Vk0FljEAgg","sub":"6b999d16-f5e5-4abd-a9f7-94a7ee89c01f","typ":"Bearer"}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.44:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"39c5ee53-718e-4589-aa6e-2080ac249a60","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"39c5ee53-718e-4589-aa6e-2080ac249a60","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"39c5ee53-718e-4589-aa6e-2080ac249a60","config":{"Name":"oidc-groups-safe","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OPA":{"Rego":"unsafe_group[g] {\n\tg := input.auth.identity.groups[_]\n\tnot regex.match(\"^[A-Za-z0-9:._/-]+$\", g)\n}\n\nallow {\n\tcount(unsafe_group) == 0\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"39c5ee53-718e-4589-aa6e-2080ac249a60","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"39c5ee53-718e-4589-aa6e-2080ac249a60","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"39c5ee53-718e-4589-aa6e-2080ac249a60","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"39c5ee53-718e-4589-aa6e-2080ac249a60","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"info","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"39c5ee53-718e-4589-aa6e-2080ac249a60","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"39c5ee53-718e-4589-aa6e-2080ac249a60","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"eddf4d18-34ae-4e93-ac04-3099c3e89b4c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:59554","PortSpecifier":{"PortValue":59554}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"eddf4d18-34ae-4e93-ac04-3099c3e89b4c","method":"GET","path":"/maas-api/v1/models","host":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"eddf4d18-34ae-4e93-ac04-3099c3e89b4c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:59554","PortSpecifier":{"PortValue":59554}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783364506,"nanos":722043425},"http":{"id":"eddf4d18-34ae-4e93-ac04-3099c3e89b4c","method":"GET","headers":{":authority":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"eddf4d18-34ae-4e93-ac04-3099c3e89b4c","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-XJ6sV9AYj4d2XFMa_VWUBKWOGL9UZVnkwEzqlc748gVgXsAKWW0hcdEVjdiy"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"eddf4d18-34ae-4e93-ac04-3099c3e89b4c","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-XJ6sV9AYj4d2XFMa_VWUBKWOGL9UZVnkwEzqlc748gVgXsAKWW0hcdEVjdiy\"}"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"eddf4d18-34ae-4e93-ac04-3099c3e89b4c","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","Engineering","Project-Alpha"],"keyId":"66e34f7a-d07a-4db9-93e6-25c1ea2f5ba0","keyName":"e2e-oidc-06507042","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"66e34f7a-d07a-4db9-93e6-25c1ea2f5ba0","username":"alice_lead","valid":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"eddf4d18-34ae-4e93-ac04-3099c3e89b4c","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"eddf4d18-34ae-4e93-ac04-3099c3e89b4c","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"eddf4d18-34ae-4e93-ac04-3099c3e89b4c","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"eddf4d18-34ae-4e93-ac04-3099c3e89b4c","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"eddf4d18-34ae-4e93-ac04-3099c3e89b4c","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"eddf4d18-34ae-4e93-ac04-3099c3e89b4c","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"eddf4d18-34ae-4e93-ac04-3099c3e89b4c","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"eddf4d18-34ae-4e93-ac04-3099c3e89b4c","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"info","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"eddf4d18-34ae-4e93-ac04-3099c3e89b4c","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"eddf4d18-34ae-4e93-ac04-3099c3e89b4c","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"caa98df5-ebf0-4b2b-99fd-c482f4c452db","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.33:51492","PortSpecifier":{"PortValue":51492}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"caa98df5-ebf0-4b2b-99fd-c482f4c452db","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"caa98df5-ebf0-4b2b-99fd-c482f4c452db","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.33:51492","PortSpecifier":{"PortValue":51492}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783364506,"nanos":730061917},"http":{"id":"caa98df5-ebf0-4b2b-99fd-c482f4c452db","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"caa98df5-ebf0-4b2b-99fd-c482f4c452db","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-XJ6sV9AYj4d2XFMa_VWUBKWOGL9UZVnkwEzqlc748gVgXsAKWW0hcdEVjdiy"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"caa98df5-ebf0-4b2b-99fd-c482f4c452db","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-XJ6sV9AYj4d2XFMa_VWUBKWOGL9UZVnkwEzqlc748gVgXsAKWW0hcdEVjdiy\"}"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"caa98df5-ebf0-4b2b-99fd-c482f4c452db","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","Engineering","Project-Alpha"],"keyId":"66e34f7a-d07a-4db9-93e6-25c1ea2f5ba0","keyName":"e2e-oidc-06507042","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"66e34f7a-d07a-4db9-93e6-25c1ea2f5ba0","username":"alice_lead","valid":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"caa98df5-ebf0-4b2b-99fd-c482f4c452db","config":"subscription-info","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"],\"requestedModel\":\"llm/facebook-opt-125m-simulated\",\"requestedSubscription\":\"simulator-subscription\",\"username\":\"alice_lead\"}"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"caa98df5-ebf0-4b2b-99fd-c482f4c452db","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"caa98df5-ebf0-4b2b-99fd-c482f4c452db","input":{"auth":{"identity":"Bearer **** subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true}}},"context":{"context_extensions":{"host":"4375a0165d777c3dbcac3b90772aafb3ba82b742e01878423b9fb1e122337433"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.44:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** sk-oai-XJ6sV9AYj4d2XFMa_VWUBKWOGL9UZVnkwEzqlc748gVgXsAKWW0hcdEVjdiy","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"facebook-opt-125m-simulated-kserve-workload-svc.llm.svc.cluster.local:8000/*","x-envoy-external-address":"10.133.0.33","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctcDVuYjQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.44~maas-default-gateway-openshift-default-56654dcf7-p5nb4.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.33","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"caa98df5-ebf0-4b2b-99fd-c482f4c452db"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"caa98df5-ebf0-4b2b-99fd-c482f4c452db","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":730061917,"seconds":1783364506},"url_path":"/llm/facebook-opt-125m-simulated/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.33:51492","port":51492}}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"caa98df5-ebf0-4b2b-99fd-c482f4c452db","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"caa98df5-ebf0-4b2b-99fd-c482f4c452db","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"caa98df5-ebf0-4b2b-99fd-c482f4c452db","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"caa98df5-ebf0-4b2b-99fd-c482f4c452db","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"caa98df5-ebf0-4b2b-99fd-c482f4c452db","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"caa98df5-ebf0-4b2b-99fd-c482f4c452db","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"caa98df5-ebf0-4b2b-99fd-c482f4c452db","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"caa98df5-ebf0-4b2b-99fd-c482f4c452db","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","Engineering","Project-Alpha"],"groups_str":"system:authenticated,Engineering,Project-Alpha","keyId":"66e34f7a-d07a-4db9-93e6-25c1ea2f5ba0","keyName":"e2e-oidc-06507042","selected_subscription":"simulator-subscription","selected_subscription_key":"models-as-a-service/simulator-subscription@llm/facebook-opt-125m-simulated","subscription_error":"","subscription_error_message":"","subscription_info":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true},"userid":"alice_lead"}}
{"level":"info","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"caa98df5-ebf0-4b2b-99fd-c482f4c452db","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"caa98df5-ebf0-4b2b-99fd-c482f4c452db","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"4e5e575e-c10a-429d-8934-580718e74cb5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:59564","PortSpecifier":{"PortValue":59564}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"4e5e575e-c10a-429d-8934-580718e74cb5","method":"GET","path":"/maas-api/v1/models","host":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"4e5e575e-c10a-429d-8934-580718e74cb5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:59564","PortSpecifier":{"PortValue":59564}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783364506,"nanos":763674194},"http":{"id":"4e5e575e-c10a-429d-8934-580718e74cb5","method":"GET","headers":{":authority":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"4e5e575e-c10a-429d-8934-580718e74cb5","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-XJ6sV9AYj4d2XFMa_VWUBKWOGL9UZVnkwEzqlc748gVgXsAKWW0hcdEVjdiy"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"4e5e575e-c10a-429d-8934-580718e74cb5","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-XJ6sV9AYj4d2XFMa_VWUBKWOGL9UZVnkwEzqlc748gVgXsAKWW0hcdEVjdiy\"}"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"4e5e575e-c10a-429d-8934-580718e74cb5","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","Engineering","Project-Alpha"],"keyId":"66e34f7a-d07a-4db9-93e6-25c1ea2f5ba0","keyName":"e2e-oidc-06507042","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"66e34f7a-d07a-4db9-93e6-25c1ea2f5ba0","username":"alice_lead","valid":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"4e5e575e-c10a-429d-8934-580718e74cb5","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4e5e575e-c10a-429d-8934-580718e74cb5","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4e5e575e-c10a-429d-8934-580718e74cb5","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4e5e575e-c10a-429d-8934-580718e74cb5","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4e5e575e-c10a-429d-8934-580718e74cb5","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"4e5e575e-c10a-429d-8934-580718e74cb5","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4e5e575e-c10a-429d-8934-580718e74cb5","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4e5e575e-c10a-429d-8934-580718e74cb5","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"alice_lead"}
{"level":"info","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4e5e575e-c10a-429d-8934-580718e74cb5","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4e5e575e-c10a-429d-8934-580718e74cb5","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"47dea511-ce33-432c-a47a-b588e0565e00","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.33:51492","PortSpecifier":{"PortValue":51492}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"47dea511-ce33-432c-a47a-b588e0565e00","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"47dea511-ce33-432c-a47a-b588e0565e00","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.33:51492","PortSpecifier":{"PortValue":51492}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783364506,"nanos":771304644},"http":{"id":"47dea511-ce33-432c-a47a-b588e0565e00","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"47dea511-ce33-432c-a47a-b588e0565e00","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-XJ6sV9AYj4d2XFMa_VWUBKWOGL9UZVnkwEzqlc748gVgXsAKWW0hcdEVjdiy"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"47dea511-ce33-432c-a47a-b588e0565e00","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-XJ6sV9AYj4d2XFMa_VWUBKWOGL9UZVnkwEzqlc748gVgXsAKWW0hcdEVjdiy\"}"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"47dea511-ce33-432c-a47a-b588e0565e00","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","Engineering","Project-Alpha"],"keyId":"66e34f7a-d07a-4db9-93e6-25c1ea2f5ba0","keyName":"e2e-oidc-06507042","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"66e34f7a-d07a-4db9-93e6-25c1ea2f5ba0","username":"alice_lead","valid":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"47dea511-ce33-432c-a47a-b588e0565e00","config":"subscription-info","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"],\"requestedModel\":\"llm/facebook-opt-125m-simulated\",\"requestedSubscription\":\"simulator-subscription\",\"username\":\"alice_lead\"}"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"47dea511-ce33-432c-a47a-b588e0565e00","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"47dea511-ce33-432c-a47a-b588e0565e00","input":{"auth":{"identity":"Bearer **** subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true}}},"context":{"context_extensions":{"host":"4375a0165d777c3dbcac3b90772aafb3ba82b742e01878423b9fb1e122337433"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.44:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** sk-oai-XJ6sV9AYj4d2XFMa_VWUBKWOGL9UZVnkwEzqlc748gVgXsAKWW0hcdEVjdiy","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"facebook-opt-125m-simulated-kserve-workload-svc.llm.svc.cluster.local:8000/*","x-envoy-external-address":"10.133.0.33","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctcDVuYjQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.44~maas-default-gateway-openshift-default-56654dcf7-p5nb4.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.33","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"47dea511-ce33-432c-a47a-b588e0565e00"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"47dea511-ce33-432c-a47a-b588e0565e00","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":771304644,"seconds":1783364506},"url_path":"/llm/facebook-opt-125m-simulated/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.33:51492","port":51492}}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"47dea511-ce33-432c-a47a-b588e0565e00","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"47dea511-ce33-432c-a47a-b588e0565e00","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"47dea511-ce33-432c-a47a-b588e0565e00","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"47dea511-ce33-432c-a47a-b588e0565e00","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"47dea511-ce33-432c-a47a-b588e0565e00","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"47dea511-ce33-432c-a47a-b588e0565e00","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"47dea511-ce33-432c-a47a-b588e0565e00","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"47dea511-ce33-432c-a47a-b588e0565e00","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","Engineering","Project-Alpha"],"groups_str":"system:authenticated,Engineering,Project-Alpha","keyId":"66e34f7a-d07a-4db9-93e6-25c1ea2f5ba0","keyName":"e2e-oidc-06507042","selected_subscription":"simulator-subscription","selected_subscription_key":"models-as-a-service/simulator-subscription@llm/facebook-opt-125m-simulated","subscription_error":"","subscription_error_message":"","subscription_info":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true},"userid":"alice_lead"}}
{"level":"info","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"47dea511-ce33-432c-a47a-b588e0565e00","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"47dea511-ce33-432c-a47a-b588e0565e00","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"fe654b35-9494-431a-ac06-9ae2770fc913","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:59574","PortSpecifier":{"PortValue":59574}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"fe654b35-9494-431a-ac06-9ae2770fc913","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"fe654b35-9494-431a-ac06-9ae2770fc913","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:59574","PortSpecifier":{"PortValue":59574}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783364506,"nanos":873455381},"http":{"id":"fe654b35-9494-431a-ac06-9ae2770fc913","method":"POST","headers":{":authority":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"fe654b35-9494-431a-ac06-9ae2770fc913","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783364566,"groups":["Engineering","Project-Alpha"],"iat":1783364506,"iss":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:181ae3d5-2793-3130-99fc-3cda726bcda1","preferred_username":"alice_lead","scope":"profile email","sid":"JKhXr7b-9m2L2SNek0wwfxBo","sub":"6b999d16-f5e5-4abd-a9f7-94a7ee89c01f","typ":"Bearer"}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"fe654b35-9494-431a-ac06-9ae2770fc913","input":{"auth":{"identity":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783364566,"groups":["Engineering","Project-Alpha"],"iat":1783364506,"iss":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:181ae3d5-2793-3130-99fc-3cda726bcda1","preferred_username":"alice_lead","scope":"profile email","sid":"JKhXr7b-9m2L2SNek0wwfxBo","sub":"6b999d16-f5e5-4abd-a9f7-94a7ee89c01f","typ":"Bearer"}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.44:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fe654b35-9494-431a-ac06-9ae2770fc913","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fe654b35-9494-431a-ac06-9ae2770fc913","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fe654b35-9494-431a-ac06-9ae2770fc913","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fe654b35-9494-431a-ac06-9ae2770fc913","config":{"Name":"oidc-groups-safe","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OPA":{"Rego":"unsafe_group[g] {\n\tg := input.auth.identity.groups[_]\n\tnot regex.match(\"^[A-Za-z0-9:._/-]+$\", g)\n}\n\nallow {\n\tcount(unsafe_group) == 0\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"fe654b35-9494-431a-ac06-9ae2770fc913","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"fe654b35-9494-431a-ac06-9ae2770fc913","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"fe654b35-9494-431a-ac06-9ae2770fc913","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"info","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"fe654b35-9494-431a-ac06-9ae2770fc913","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"fe654b35-9494-431a-ac06-9ae2770fc913","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T19:01:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/825b4e4809451f9debccbe1150b699f739c117934b0bf98871cc2a21cd18800d"}
{"level":"info","ts":"2026-07-06T19:01:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/86345123ead4f37c7ec089e50cf7cc6cbfc5de47b541dbabfaa88510bcb6732b"}
{"level":"info","ts":"2026-07-06T19:02:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/cbee4de24e7f52377467bc1c31e35371aa80bf91cd74077a1bc0ff135956cb05"}
{"level":"info","ts":"2026-07-06T19:02:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/eb2791bd549e8278812cf508beb14dde3010dd6c48eb99afe00a94c55d9ae82a"}