{"level":"debug","ts":"2026-07-06T19:00:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"98b043f0-cf56-47a1-a1ce-8a968ef34043","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:00:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"98b043f0-cf56-47a1-a1ce-8a968ef34043","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-06T19:00:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"98b043f0-cf56-47a1-a1ce-8a968ef34043","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-06T19:00:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"98b043f0-cf56-47a1-a1ce-8a968ef34043","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-dd4fe8"}
{"level":"debug","ts":"2026-07-06T19:00:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"98b043f0-cf56-47a1-a1ce-8a968ef34043","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"d637848f-70e1-4cb8-a520-a94932db2639","keyName":"e2e-rate-a-dd4fe8","selected_subscription":"e2e-rate-iso-a-dd4fe8","selected_subscription_key":"ai-tenant-e2e-shared-a-47f1eb/e2e-rate-iso-a-dd4fe8@ai-tenant-e2e-shared-a-47f1eb/rate-test-model-47f1eb","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-47f1eb","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-dd4fe8","namespace":"ai-tenant-e2e-shared-a-47f1eb","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-06T19:00:34Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"98b043f0-cf56-47a1-a1ce-8a968ef34043","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T19:00:34Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"98b043f0-cf56-47a1-a1ce-8a968ef34043","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T19:00:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b4e629b5-799a-47fb-8376-7dca7bc2c7cb","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:58446","PortSpecifier":{"PortValue":58446}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.66:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"b4e629b5-799a-47fb-8376-7dca7bc2c7cb","method":"POST","path":"/ai-tenant-e2e-shared-a-47f1eb/rate-test-model-47f1eb/v1/completions","host":"e2e-shared-a-47f1eb.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T19:00:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b4e629b5-799a-47fb-8376-7dca7bc2c7cb","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:58446","PortSpecifier":{"PortValue":58446}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.66:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783364435,"nanos":833545925},"http":{"id":"b4e629b5-799a-47fb-8376-7dca7bc2c7cb","method":"POST","headers":{":authority":"e2e-shared-a-47f1eb.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-47f1eb/rate-test-model-47f1eb/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:00:35Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"b4e629b5-799a-47fb-8376-7dca7bc2c7cb","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1GF63b6DEY6Szi4tW_XYgEFLNUVxLTeaRtPc1RUidRRtcFvP1dj7OzgqCQfqB"}
{"level":"debug","ts":"2026-07-06T19:00:35Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"b4e629b5-799a-47fb-8376-7dca7bc2c7cb","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-47f1eb.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1GF63b6DEY6Szi4tW_XYgEFLNUVxLTeaRtPc1RUidRRtcFvP1dj7OzgqCQfqB\"}"}
{"level":"debug","ts":"2026-07-06T19:00:35Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"b4e629b5-799a-47fb-8376-7dca7bc2c7cb","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-47f1eb.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"d637848f-70e1-4cb8-a520-a94932db2639","keyName":"e2e-rate-a-dd4fe8","subscription":"e2e-rate-iso-a-dd4fe8","tenant":"e2e-shared-a-47f1eb","userId":"d637848f-70e1-4cb8-a520-a94932db2639","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-06T19:00:35Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"b4e629b5-799a-47fb-8376-7dca7bc2c7cb","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-47f1eb.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-47f1eb/rate-test-model-47f1eb\",\"requestedSubscription\":\"e2e-rate-iso-a-dd4fe8\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-06T19:00:35Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"b4e629b5-799a-47fb-8376-7dca7bc2c7cb","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-47f1eb.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-47f1eb","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-dd4fe8","namespace":"ai-tenant-e2e-shared-a-47f1eb","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-06T19:00:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"b4e629b5-799a-47fb-8376-7dca7bc2c7cb","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:00:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b4e629b5-799a-47fb-8376-7dca7bc2c7cb","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:00:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b4e629b5-799a-47fb-8376-7dca7bc2c7cb","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:00:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b4e629b5-799a-47fb-8376-7dca7bc2c7cb","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:00:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b4e629b5-799a-47fb-8376-7dca7bc2c7cb","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-47f1eb/rate-test-model-47f1eb\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:00:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b4e629b5-799a-47fb-8376-7dca7bc2c7cb","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-06T19:00:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b4e629b5-799a-47fb-8376-7dca7bc2c7cb","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-dd4fe8"}
{"level":"debug","ts":"2026-07-06T19:00:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b4e629b5-799a-47fb-8376-7dca7bc2c7cb","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-06T19:00:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b4e629b5-799a-47fb-8376-7dca7bc2c7cb","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"d637848f-70e1-4cb8-a520-a94932db2639","keyName":"e2e-rate-a-dd4fe8","selected_subscription":"e2e-rate-iso-a-dd4fe8","selected_subscription_key":"ai-tenant-e2e-shared-a-47f1eb/e2e-rate-iso-a-dd4fe8@ai-tenant-e2e-shared-a-47f1eb/rate-test-model-47f1eb","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-47f1eb","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-dd4fe8","namespace":"ai-tenant-e2e-shared-a-47f1eb","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-06T19:00:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b4e629b5-799a-47fb-8376-7dca7bc2c7cb","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T19:00:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b4e629b5-799a-47fb-8376-7dca7bc2c7cb","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T19:00:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"95b79980-89d1-4921-98b3-1ab628543a0f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:50138","PortSpecifier":{"PortValue":50138}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.67:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"95b79980-89d1-4921-98b3-1ab628543a0f","method":"POST","path":"/ai-tenant-e2e-shared-b-b19850/rate-test-model-b19850/v1/completions","host":"e2e-shared-b-b19850.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T19:00:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"95b79980-89d1-4921-98b3-1ab628543a0f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:50138","PortSpecifier":{"PortValue":50138}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.67:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783364435,"nanos":867124485},"http":{"id":"95b79980-89d1-4921-98b3-1ab628543a0f","method":"POST","headers":{":authority":"e2e-shared-b-b19850.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-b-b19850/rate-test-model-b19850/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:00:35Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"95b79980-89d1-4921-98b3-1ab628543a0f","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-riaVn6QBf9U5zDw5_4oQ68MRqmCtRMhsqCNxLZXMhpipmhjIwWsD7Xq5A5Ie"}
{"level":"debug","ts":"2026-07-06T19:00:35Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"95b79980-89d1-4921-98b3-1ab628543a0f","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-b-b19850.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-riaVn6QBf9U5zDw5_4oQ68MRqmCtRMhsqCNxLZXMhpipmhjIwWsD7Xq5A5Ie\"}"}
{"level":"debug","ts":"2026-07-06T19:00:35Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"95b79980-89d1-4921-98b3-1ab628543a0f","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-b19850.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"13b16411-61f5-480d-8a71-b4a24c0cd3bd","keyName":"e2e-rate-b-dd4fe8","subscription":"e2e-rate-iso-b-dd4fe8","tenant":"e2e-shared-b-b19850","userId":"13b16411-61f5-480d-8a71-b4a24c0cd3bd","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-06T19:00:35Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"95b79980-89d1-4921-98b3-1ab628543a0f","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-b-b19850.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-b-b19850/rate-test-model-b19850\",\"requestedSubscription\":\"e2e-rate-iso-b-dd4fe8\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-06T19:00:35Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"95b79980-89d1-4921-98b3-1ab628543a0f","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-b19850.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-b19850","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-dd4fe8","namespace":"ai-tenant-e2e-shared-b-b19850","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-06T19:00:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"95b79980-89d1-4921-98b3-1ab628543a0f","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:00:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"95b79980-89d1-4921-98b3-1ab628543a0f","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:00:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"95b79980-89d1-4921-98b3-1ab628543a0f","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:00:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"95b79980-89d1-4921-98b3-1ab628543a0f","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:00:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"95b79980-89d1-4921-98b3-1ab628543a0f","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-b19850/rate-test-model-b19850\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:00:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"95b79980-89d1-4921-98b3-1ab628543a0f","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-06T19:00:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"95b79980-89d1-4921-98b3-1ab628543a0f","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-b-dd4fe8"}
{"level":"debug","ts":"2026-07-06T19:00:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"95b79980-89d1-4921-98b3-1ab628543a0f","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-06T19:00:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"95b79980-89d1-4921-98b3-1ab628543a0f","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"13b16411-61f5-480d-8a71-b4a24c0cd3bd","keyName":"e2e-rate-b-dd4fe8","selected_subscription":"e2e-rate-iso-b-dd4fe8","selected_subscription_key":"ai-tenant-e2e-shared-b-b19850/e2e-rate-iso-b-dd4fe8@ai-tenant-e2e-shared-b-b19850/rate-test-model-b19850","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-b19850","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-dd4fe8","namespace":"ai-tenant-e2e-shared-b-b19850","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-06T19:00:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"95b79980-89d1-4921-98b3-1ab628543a0f","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T19:00:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"95b79980-89d1-4921-98b3-1ab628543a0f","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T19:00:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3a345f70-0fca-41c1-945a-88ac82b44baf","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:42130","PortSpecifier":{"PortValue":42130}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"3a345f70-0fca-41c1-945a-88ac82b44baf","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T19:00:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3a345f70-0fca-41c1-945a-88ac82b44baf","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:42130","PortSpecifier":{"PortValue":42130}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783364439,"nanos":336791577},"http":{"id":"3a345f70-0fca-41c1-945a-88ac82b44baf","method":"POST","headers":{":authority":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:00:39Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"3a345f70-0fca-41c1-945a-88ac82b44baf","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783364499,"groups":["Engineering","Project-Alpha"],"iat":1783364439,"iss":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:45577ee1-1589-3438-8d05-8c5e9ba63878","preferred_username":"alice_lead","scope":"profile email","sid":"VOhY1qyw6Gz0dMPClchrzLbv","sub":"6b999d16-f5e5-4abd-a9f7-94a7ee89c01f","typ":"Bearer"}}
{"level":"debug","ts":"2026-07-06T19:00:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"3a345f70-0fca-41c1-945a-88ac82b44baf","input":{"auth":{"identity":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783364499,"groups":["Engineering","Project-Alpha"],"iat":1783364439,"iss":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:45577ee1-1589-3438-8d05-8c5e9ba63878","preferred_username":"alice_lead","scope":"profile email","sid":"VOhY1qyw6Gz0dMPClchrzLbv","sub":"6b999d16-f5e5-4abd-a9f7-94a7ee89c01f","typ":"Bearer"}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.44:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:00:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3a345f70-0fca-41c1-945a-88ac82b44baf","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:00:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3a345f70-0fca-41c1-945a-88ac82b44baf","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:00:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3a345f70-0fca-41c1-945a-88ac82b44baf","config":{"Name":"oidc-groups-safe","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OPA":{"Rego":"unsafe_group[g] {\n\tg := input.auth.identity.groups[_]\n\tnot regex.match(\"^[A-Za-z0-9:._/-]+$\", g)\n}\n\nallow {\n\tcount(unsafe_group) == 0\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:00:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3a345f70-0fca-41c1-945a-88ac82b44baf","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:00:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"3a345f70-0fca-41c1-945a-88ac82b44baf","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-06T19:00:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3a345f70-0fca-41c1-945a-88ac82b44baf","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-06T19:00:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3a345f70-0fca-41c1-945a-88ac82b44baf","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"info","ts":"2026-07-06T19:00:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3a345f70-0fca-41c1-945a-88ac82b44baf","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T19:00:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3a345f70-0fca-41c1-945a-88ac82b44baf","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T19:00:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a4ec0e5c-7f95-4c16-bc1d-89878526fe1f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:42146","PortSpecifier":{"PortValue":42146}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"a4ec0e5c-7f95-4c16-bc1d-89878526fe1f","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T19:00:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a4ec0e5c-7f95-4c16-bc1d-89878526fe1f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:42146","PortSpecifier":{"PortValue":42146}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783364439,"nanos":451634540},"http":{"id":"a4ec0e5c-7f95-4c16-bc1d-89878526fe1f","method":"POST","headers":{":authority":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:00:39Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"a4ec0e5c-7f95-4c16-bc1d-89878526fe1f","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-07-06T19:00:39Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"a4ec0e5c-7f95-4c16-bc1d-89878526fe1f","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-06T19:00:39Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"a4ec0e5c-7f95-4c16-bc1d-89878526fe1f","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"not authenticated"}
{"level":"info","ts":"2026-07-06T19:00:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a4ec0e5c-7f95-4c16-bc1d-89878526fe1f","authorized":false,"response":"UNAUTHENTICATED","object":{"code":16,"status":401,"message":"Authentication required"}}
{"level":"debug","ts":"2026-07-06T19:00:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a4ec0e5c-7f95-4c16-bc1d-89878526fe1f","authorized":false,"response":"UNAUTHENTICATED","object":{"code":16,"status":401,"message":"Authentication required","headers":[{"WWW-Authenticate":"request.headers.authorization realm=\"api-keys\""},{"WWW-Authenticate":"Bearer **** realm=\"openshift-identities\""}]}}
{"level":"info","ts":"2026-07-06T19:00:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"53cb3d46-74f6-4b43-93a5-0feefa2a3bca","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:42162","PortSpecifier":{"PortValue":42162}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"53cb3d46-74f6-4b43-93a5-0feefa2a3bca","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T19:00:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"53cb3d46-74f6-4b43-93a5-0feefa2a3bca","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:42162","PortSpecifier":{"PortValue":42162}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783364439,"nanos":556992176},"http":{"id":"53cb3d46-74f6-4b43-93a5-0feefa2a3bca","method":"POST","headers":{":authority":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer","content-length":"35","content-type":"application/json","forwarded":"for=34.228.250.194;host=maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com;proto=https","user-agent":"python-requests/2.32.5","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.9","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctcDVuYjQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.44~maas-default-gateway-openshift-default-56654dcf7-p5nb4.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"34.228.250.194,10.133.0.9","x-forwarded-host":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com","x-forwarded-port":"443","x-forwarded-proto":"https","x-request-id":"53cb3d46-74f6-4b43-93a5-0feefa2a3bca"},"path":"/maas-api/v1/api-keys","host":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com","scheme":"https","protocol":"HTTP/1.1"}},"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"metadata_context":{}}}
{"level":"debug","ts":"2026-07-06T19:00:39Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"53cb3d46-74f6-4b43-93a5-0feefa2a3bca","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"credential not found"}
{"level":"info","ts":"2026-07-06T19:00:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"53cb3d46-74f6-4b43-93a5-0feefa2a3bca","authorized":false,"response":"UNAUTHENTICATED","object":{"code":16,"status":401,"message":"Authentication required"}}
{"level":"debug","ts":"2026-07-06T19:00:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"53cb3d46-74f6-4b43-93a5-0feefa2a3bca","authorized":false,"response":"UNAUTHENTICATED","object":{"code":16,"status":401,"message":"Authentication required","headers":[{"WWW-Authenticate":"request.headers.authorization realm=\"api-keys\""},{"WWW-Authenticate":"Bearer **** realm=\"openshift-identities\""}]}}
{"level":"info","ts":"2026-07-06T19:00:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"54392383-6941-41a2-95a4-af024a4c6f43","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:42176","PortSpecifier":{"PortValue":42176}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"54392383-6941-41a2-95a4-af024a4c6f43","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T19:00:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"54392383-6941-41a2-95a4-af024a4c6f43","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:42176","PortSpecifier":{"PortValue":42176}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783364439,"nanos":582814619},"http":{"id":"54392383-6941-41a2-95a4-af024a4c6f43","method":"POST","headers":{":authority":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","content-length":"36","content-type":"application/json","forwarded":"for=34.228.250.194;host=maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com;proto=https","user-agent":"python-requests/2.32.5","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.9","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctcDVuYjQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.44~maas-default-gateway-openshift-default-56654dcf7-p5nb4.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"34.228.250.194,10.133.0.9","x-forwarded-host":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com","x-forwarded-port":"443","x-forwarded-proto":"https","x-request-id":"54392383-6941-41a2-95a4-af024a4c6f43"},"path":"/maas-api/v1/api-keys","host":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com","scheme":"https","protocol":"HTTP/1.1"}},"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"metadata_context":{}}}
{"level":"info","ts":"2026-07-06T19:00:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"54392383-6941-41a2-95a4-af024a4c6f43","authorized":false,"response":"UNAUTHENTICATED","object":{"code":16,"status":401,"message":"Authentication required"}}
{"level":"debug","ts":"2026-07-06T19:00:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"54392383-6941-41a2-95a4-af024a4c6f43","authorized":false,"response":"UNAUTHENTICATED","object":{"code":16,"status":401,"message":"Authentication required","headers":[{"WWW-Authenticate":"request.headers.authorization realm=\"api-keys\""},{"WWW-Authenticate":"Bearer **** realm=\"openshift-identities\""}]}}
{"level":"info","ts":"2026-07-06T19:00:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c2aab7b4-5583-4d0c-9901-a247e83d06ef","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:42184","PortSpecifier":{"PortValue":42184}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"c2aab7b4-5583-4d0c-9901-a247e83d06ef","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T19:00:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c2aab7b4-5583-4d0c-9901-a247e83d06ef","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:42184","PortSpecifier":{"PortValue":42184}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783364439,"nanos":670406707},"http":{"id":"c2aab7b4-5583-4d0c-9901-a247e83d06ef","method":"POST","headers":{":authority":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:00:39Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"c2aab7b4-5583-4d0c-9901-a247e83d06ef","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"oidc: token is expired (Token Expiry: 2026-07-06 18:00:39 +0000 UTC)"}
{"level":"debug","ts":"2026-07-06T19:00:39Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"c2aab7b4-5583-4d0c-9901-a247e83d06ef","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-06T19:00:39Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"c2aab7b4-5583-4d0c-9901-a247e83d06ef","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"not authenticated"}
{"level":"info","ts":"2026-07-06T19:00:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c2aab7b4-5583-4d0c-9901-a247e83d06ef","authorized":false,"response":"UNAUTHENTICATED","object":{"code":16,"status":401,"message":"Authentication required"}}
{"level":"debug","ts":"2026-07-06T19:00:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c2aab7b4-5583-4d0c-9901-a247e83d06ef","authorized":false,"response":"UNAUTHENTICATED","object":{"code":16,"status":401,"message":"Authentication required","headers":[{"WWW-Authenticate":"request.headers.authorization realm=\"api-keys\""},{"WWW-Authenticate":"Bearer **** realm=\"openshift-identities\""}]}}
{"level":"info","ts":"2026-07-06T19:00:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/87a150eabc7659da2832b5d5f95adaf4b9a45a76bf4b3b01eb3be5b331c1f349"}
{"level":"info","ts":"2026-07-06T19:00:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/8dd963d9fdee69e495f1d79fa7b59322ec1d8328bba623f2ca62c54bb829402e"}
{"level":"info","ts":"2026-07-06T19:00:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/7502b45ed071984dbeda4aed13e858926b7ad79e7003a8ec77863722ce02bd5e"}
{"level":"info","ts":"2026-07-06T19:00:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/5ec9866941ade64c99d441c372799ca42f409b0794a7903ae0c6029a45fc0056"}
{"level":"info","ts":"2026-07-06T19:00:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/8303d1bdcc7075b5fd8e6468df2196e7112596d35afc4edb06dccf7484f396bb"}
{"level":"info","ts":"2026-07-06T19:00:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/58bf29a02801972c7f59b1466d5bbc3c0ed035c240cdaea6a916bc01bbcd6f48"}
{"level":"info","ts":"2026-07-06T19:00:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/147688dfcb763649fb21d37d56b8c9a5eaea30776c327a0ad88421eb8647437d"}
{"level":"info","ts":"2026-07-06T19:00:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/6ca4e8b470af39adaba6d354315da786e395454d9c08b0c0f160979fb65af263"}
{"level":"info","ts":"2026-07-06T19:00:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/5cbb644a58fc4f41c2dc3c9132b9d5a444d13468498b369f90ef7710141fd409"}
{"level":"info","ts":"2026-07-06T19:00:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/9ad78b9023cc5a240a2d2d4fa3cf6b0048402533ea66bf7e0f3025ea88619696"}
{"level":"info","ts":"2026-07-06T19:00:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/f050fbdb2027a47041339e2497a427bf2a259f8bb025b2ff3c5540fa5031ce18"}
{"level":"info","ts":"2026-07-06T19:00:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/8b1d89ed651da0c2fe2c43f9b6502ed2f2a48bbb88f43f119606a9d12ac3a9a9"}
{"level":"info","ts":"2026-07-06T19:00:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/3a0f9c9dc56e9c56e4cc3a1a02dafc2c892dee0417dca18ab5b923374d7a6b1d"}
{"level":"info","ts":"2026-07-06T19:00:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/a8db3e05c0ce7a595b7845bfe4f4219f6fabcea2e7f26f378c3989d3017c5b8d"}
{"level":"info","ts":"2026-07-06T19:00:45Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/e1f91f29a92736910355bd01a5ee338aa8c3cb166ff184f4e29f7f98d47ae16f"}
{"level":"info","ts":"2026-07-06T19:00:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/7d66c6155f092639a8500b207fd49a41c5d4137d324a46572c9aaa18ae319b20"}
{"level":"info","ts":"2026-07-06T19:01:44Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e7f76ec5-aa3e-4b6b-8b90-82ac2c1f0f59","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:59380","PortSpecifier":{"PortValue":59380}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"e7f76ec5-aa3e-4b6b-8b90-82ac2c1f0f59","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T19:01:44Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e7f76ec5-aa3e-4b6b-8b90-82ac2c1f0f59","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:59380","PortSpecifier":{"PortValue":59380}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783364504,"nanos":786249713},"http":{"id":"e7f76ec5-aa3e-4b6b-8b90-82ac2c1f0f59","method":"POST","headers":{":authority":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:01:44Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"e7f76ec5-aa3e-4b6b-8b90-82ac2c1f0f59","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"oidc: token is expired (Token Expiry: 2026-07-06 19:01:39 +0000 UTC)"}
{"level":"debug","ts":"2026-07-06T19:01:44Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"e7f76ec5-aa3e-4b6b-8b90-82ac2c1f0f59","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-06T19:01:44Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"e7f76ec5-aa3e-4b6b-8b90-82ac2c1f0f59","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"not authenticated"}
{"level":"info","ts":"2026-07-06T19:01:44Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e7f76ec5-aa3e-4b6b-8b90-82ac2c1f0f59","authorized":false,"response":"UNAUTHENTICATED","object":{"code":16,"status":401,"message":"Authentication required"}}
{"level":"debug","ts":"2026-07-06T19:01:44Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e7f76ec5-aa3e-4b6b-8b90-82ac2c1f0f59","authorized":false,"response":"UNAUTHENTICATED","object":{"code":16,"status":401,"message":"Authentication required","headers":[{"WWW-Authenticate":"request.headers.authorization realm=\"api-keys\""},{"WWW-Authenticate":"Bearer **** realm=\"openshift-identities\""}]}}
{"level":"info","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7ecec448-77ca-4413-8b50-a05486b94b6e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:59384","PortSpecifier":{"PortValue":59384}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"7ecec448-77ca-4413-8b50-a05486b94b6e","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7ecec448-77ca-4413-8b50-a05486b94b6e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:59384","PortSpecifier":{"PortValue":59384}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783364505,"nanos":232778284},"http":{"id":"7ecec448-77ca-4413-8b50-a05486b94b6e","method":"POST","headers":{":authority":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"7ecec448-77ca-4413-8b50-a05486b94b6e","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783364565,"groups":["Site-Reliability"],"iat":1783364505,"iss":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:c3a6090f-8a89-76f4-9f01-df17a17f5cb4","preferred_username":"bob_sre","scope":"profile email","sid":"CWXnOsDtuPBdKm-8S4BnTtLG","sub":"fdf43355-8302-4a9a-9bcd-e7f0d0a3a147","typ":"Bearer"}}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"7ecec448-77ca-4413-8b50-a05486b94b6e","input":{"auth":{"identity":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783364565,"groups":["Site-Reliability"],"iat":1783364505,"iss":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:c3a6090f-8a89-76f4-9f01-df17a17f5cb4","preferred_username":"bob_sre","scope":"profile email","sid":"CWXnOsDtuPBdKm-8S4BnTtLG","sub":"fdf43355-8302-4a9a-9bcd-e7f0d0a3a147","typ":"Bearer"}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.44:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7ecec448-77ca-4413-8b50-a05486b94b6e","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7ecec448-77ca-4413-8b50-a05486b94b6e","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7ecec448-77ca-4413-8b50-a05486b94b6e","config":{"Name":"oidc-groups-safe","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OPA":{"Rego":"unsafe_group[g] {\n\tg := input.auth.identity.groups[_]\n\tnot regex.match(\"^[A-Za-z0-9:._/-]+$\", g)\n}\n\nallow {\n\tcount(unsafe_group) == 0\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7ecec448-77ca-4413-8b50-a05486b94b6e","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"7ecec448-77ca-4413-8b50-a05486b94b6e","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7ecec448-77ca-4413-8b50-a05486b94b6e","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"bob_sre"}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7ecec448-77ca-4413-8b50-a05486b94b6e","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Site-Reliability\"]"}
{"level":"info","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7ecec448-77ca-4413-8b50-a05486b94b6e","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7ecec448-77ca-4413-8b50-a05486b94b6e","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a4beb8a6-fcd8-4eba-a7d9-44b84ecc93b6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:59388","PortSpecifier":{"PortValue":59388}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"a4beb8a6-fcd8-4eba-a7d9-44b84ecc93b6","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a4beb8a6-fcd8-4eba-a7d9-44b84ecc93b6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:59388","PortSpecifier":{"PortValue":59388}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783364505,"nanos":466815425},"http":{"id":"a4beb8a6-fcd8-4eba-a7d9-44b84ecc93b6","method":"POST","headers":{":authority":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"a4beb8a6-fcd8-4eba-a7d9-44b84ecc93b6","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783364565,"groups":["Engineering","Project-Alpha"],"iat":1783364505,"iss":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:98cf0e6f-e535-4c0c-18b4-28f6a618d923","preferred_username":"alice_lead","scope":"profile email","sid":"QNiVr2CHMRTg6LbB1vdZ5tBx","sub":"6b999d16-f5e5-4abd-a9f7-94a7ee89c01f","typ":"Bearer"}}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"a4beb8a6-fcd8-4eba-a7d9-44b84ecc93b6","input":{"auth":{"identity":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783364565,"groups":["Engineering","Project-Alpha"],"iat":1783364505,"iss":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:98cf0e6f-e535-4c0c-18b4-28f6a618d923","preferred_username":"alice_lead","scope":"profile email","sid":"QNiVr2CHMRTg6LbB1vdZ5tBx","sub":"6b999d16-f5e5-4abd-a9f7-94a7ee89c01f","typ":"Bearer"}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.44:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a4beb8a6-fcd8-4eba-a7d9-44b84ecc93b6","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a4beb8a6-fcd8-4eba-a7d9-44b84ecc93b6","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a4beb8a6-fcd8-4eba-a7d9-44b84ecc93b6","config":{"Name":"oidc-groups-safe","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OPA":{"Rego":"unsafe_group[g] {\n\tg := input.auth.identity.groups[_]\n\tnot regex.match(\"^[A-Za-z0-9:._/-]+$\", g)\n}\n\nallow {\n\tcount(unsafe_group) == 0\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a4beb8a6-fcd8-4eba-a7d9-44b84ecc93b6","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"a4beb8a6-fcd8-4eba-a7d9-44b84ecc93b6","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a4beb8a6-fcd8-4eba-a7d9-44b84ecc93b6","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a4beb8a6-fcd8-4eba-a7d9-44b84ecc93b6","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"info","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a4beb8a6-fcd8-4eba-a7d9-44b84ecc93b6","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a4beb8a6-fcd8-4eba-a7d9-44b84ecc93b6","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5b13920c-35ba-47be-9723-8af8a6655542","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:59400","PortSpecifier":{"PortValue":59400}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"5b13920c-35ba-47be-9723-8af8a6655542","method":"GET","path":"/maas-api/v1/models","host":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5b13920c-35ba-47be-9723-8af8a6655542","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:59400","PortSpecifier":{"PortValue":59400}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783364505,"nanos":500022586},"http":{"id":"5b13920c-35ba-47be-9723-8af8a6655542","method":"GET","headers":{":authority":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"5b13920c-35ba-47be-9723-8af8a6655542","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-yp2hZnKZd6kDtxtU_W9yCwZIleoJcfs9tVEcdV5jlf1PPtGWlKXCMFBWE2l3"}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"5b13920c-35ba-47be-9723-8af8a6655542","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-yp2hZnKZd6kDtxtU_W9yCwZIleoJcfs9tVEcdV5jlf1PPtGWlKXCMFBWE2l3\"}"}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"5b13920c-35ba-47be-9723-8af8a6655542","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","Engineering","Project-Alpha"],"keyId":"eb888f9a-1d17-4b28-bee6-e4754f17c8cf","keyName":"e2e-oidc-2c431c6e","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"eb888f9a-1d17-4b28-bee6-e4754f17c8cf","username":"alice_lead","valid":true}}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"5b13920c-35ba-47be-9723-8af8a6655542","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5b13920c-35ba-47be-9723-8af8a6655542","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5b13920c-35ba-47be-9723-8af8a6655542","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5b13920c-35ba-47be-9723-8af8a6655542","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5b13920c-35ba-47be-9723-8af8a6655542","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"5b13920c-35ba-47be-9723-8af8a6655542","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5b13920c-35ba-47be-9723-8af8a6655542","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5b13920c-35ba-47be-9723-8af8a6655542","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"info","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5b13920c-35ba-47be-9723-8af8a6655542","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5b13920c-35ba-47be-9723-8af8a6655542","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2bb4e046-595b-4b52-b1a1-31d3a4c9712d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.33:51492","PortSpecifier":{"PortValue":51492}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"2bb4e046-595b-4b52-b1a1-31d3a4c9712d","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2bb4e046-595b-4b52-b1a1-31d3a4c9712d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.33:51492","PortSpecifier":{"PortValue":51492}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783364505,"nanos":528240636},"http":{"id":"2bb4e046-595b-4b52-b1a1-31d3a4c9712d","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"2bb4e046-595b-4b52-b1a1-31d3a4c9712d","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-yp2hZnKZd6kDtxtU_W9yCwZIleoJcfs9tVEcdV5jlf1PPtGWlKXCMFBWE2l3"}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"2bb4e046-595b-4b52-b1a1-31d3a4c9712d","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-yp2hZnKZd6kDtxtU_W9yCwZIleoJcfs9tVEcdV5jlf1PPtGWlKXCMFBWE2l3\"}"}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"2bb4e046-595b-4b52-b1a1-31d3a4c9712d","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","Engineering","Project-Alpha"],"keyId":"eb888f9a-1d17-4b28-bee6-e4754f17c8cf","keyName":"e2e-oidc-2c431c6e","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"eb888f9a-1d17-4b28-bee6-e4754f17c8cf","username":"alice_lead","valid":true}}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"2bb4e046-595b-4b52-b1a1-31d3a4c9712d","config":"subscription-info","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"],\"requestedModel\":\"llm/facebook-opt-125m-simulated\",\"requestedSubscription\":\"simulator-subscription\",\"username\":\"alice_lead\"}"}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"2bb4e046-595b-4b52-b1a1-31d3a4c9712d","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true}}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"2bb4e046-595b-4b52-b1a1-31d3a4c9712d","input":{"auth":{"identity":"Bearer **** subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true}}},"context":{"context_extensions":{"host":"4375a0165d777c3dbcac3b90772aafb3ba82b742e01878423b9fb1e122337433"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.44:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** sk-oai-yp2hZnKZd6kDtxtU_W9yCwZIleoJcfs9tVEcdV5jlf1PPtGWlKXCMFBWE2l3","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"facebook-opt-125m-simulated-kserve-workload-svc.llm.svc.cluster.local:8000/*","x-envoy-external-address":"10.133.0.33","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctcDVuYjQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.44~maas-default-gateway-openshift-default-56654dcf7-p5nb4.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.33","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"2bb4e046-595b-4b52-b1a1-31d3a4c9712d"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"2bb4e046-595b-4b52-b1a1-31d3a4c9712d","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":528240636,"seconds":1783364505},"url_path":"/llm/facebook-opt-125m-simulated/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.33:51492","port":51492}}}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2bb4e046-595b-4b52-b1a1-31d3a4c9712d","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2bb4e046-595b-4b52-b1a1-31d3a4c9712d","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2bb4e046-595b-4b52-b1a1-31d3a4c9712d","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2bb4e046-595b-4b52-b1a1-31d3a4c9712d","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2bb4e046-595b-4b52-b1a1-31d3a4c9712d","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2bb4e046-595b-4b52-b1a1-31d3a4c9712d","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2bb4e046-595b-4b52-b1a1-31d3a4c9712d","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2bb4e046-595b-4b52-b1a1-31d3a4c9712d","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","Engineering","Project-Alpha"],"groups_str":"system:authenticated,Engineering,Project-Alpha","keyId":"eb888f9a-1d17-4b28-bee6-e4754f17c8cf","keyName":"e2e-oidc-2c431c6e","selected_subscription":"simulator-subscription","selected_subscription_key":"models-as-a-service/simulator-subscription@llm/facebook-opt-125m-simulated","subscription_error":"","subscription_error_message":"","subscription_info":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true},"userid":"alice_lead"}}
{"level":"info","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2bb4e046-595b-4b52-b1a1-31d3a4c9712d","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2bb4e046-595b-4b52-b1a1-31d3a4c9712d","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f268b936-cd22-4159-9cb9-31ba943b72cd","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:59402","PortSpecifier":{"PortValue":59402}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"f268b936-cd22-4159-9cb9-31ba943b72cd","method":"POST","path":"/llm/facebook-opt-125m-simulated/v1/chat/completions","host":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f268b936-cd22-4159-9cb9-31ba943b72cd","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:59402","PortSpecifier":{"PortValue":59402}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783364505,"nanos":560068601},"http":{"id":"f268b936-cd22-4159-9cb9-31ba943b72cd","method":"POST","headers":{":authority":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com",":method":"POST",":path":"/llm/facebook-opt-125m-simulated/v1/chat/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"f268b936-cd22-4159-9cb9-31ba943b72cd","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-yp2hZnKZd6kDtxtU_W9yCwZIleoJcfs9tVEcdV5jlf1PPtGWlKXCMFBWE2l3"}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"f268b936-cd22-4159-9cb9-31ba943b72cd","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-yp2hZnKZd6kDtxtU_W9yCwZIleoJcfs9tVEcdV5jlf1PPtGWlKXCMFBWE2l3\"}"}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"f268b936-cd22-4159-9cb9-31ba943b72cd","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","Engineering","Project-Alpha"],"keyId":"eb888f9a-1d17-4b28-bee6-e4754f17c8cf","keyName":"e2e-oidc-2c431c6e","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"eb888f9a-1d17-4b28-bee6-e4754f17c8cf","username":"alice_lead","valid":true}}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"f268b936-cd22-4159-9cb9-31ba943b72cd","config":"subscription-info","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"],\"requestedModel\":\"llm/facebook-opt-125m-simulated\",\"requestedSubscription\":\"simulator-subscription\",\"username\":\"alice_lead\"}"}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"f268b936-cd22-4159-9cb9-31ba943b72cd","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true}}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"f268b936-cd22-4159-9cb9-31ba943b72cd","input":{"auth":{"identity":"Bearer **** subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true}}},"context":{"context_extensions":{"host":"311b1be286674fd5684c9ac59b318287dade9769cfe4aeebd8c88e2dc6b72418"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.44:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com",":method":"POST",":path":"/llm/facebook-opt-125m-simulated/v1/chat/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f268b936-cd22-4159-9cb9-31ba943b72cd","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f268b936-cd22-4159-9cb9-31ba943b72cd","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f268b936-cd22-4159-9cb9-31ba943b72cd","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f268b936-cd22-4159-9cb9-31ba943b72cd","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f268b936-cd22-4159-9cb9-31ba943b72cd","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f268b936-cd22-4159-9cb9-31ba943b72cd","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f268b936-cd22-4159-9cb9-31ba943b72cd","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f268b936-cd22-4159-9cb9-31ba943b72cd","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","Engineering","Project-Alpha"],"groups_str":"system:authenticated,Engineering,Project-Alpha","keyId":"eb888f9a-1d17-4b28-bee6-e4754f17c8cf","keyName":"e2e-oidc-2c431c6e","selected_subscription":"simulator-subscription","selected_subscription_key":"models-as-a-service/simulator-subscription@llm/facebook-opt-125m-simulated","subscription_error":"","subscription_error_message":"","subscription_info":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true},"userid":"alice_lead"}}
{"level":"info","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f268b936-cd22-4159-9cb9-31ba943b72cd","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f268b936-cd22-4159-9cb9-31ba943b72cd","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a41868df-dff0-4c31-8eff-1f62ca3d2192","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:59404","PortSpecifier":{"PortValue":59404}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"a41868df-dff0-4c31-8eff-1f62ca3d2192","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a41868df-dff0-4c31-8eff-1f62ca3d2192","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:59404","PortSpecifier":{"PortValue":59404}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783364505,"nanos":665690528},"http":{"id":"a41868df-dff0-4c31-8eff-1f62ca3d2192","method":"POST","headers":{":authority":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"a41868df-dff0-4c31-8eff-1f62ca3d2192","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783364565,"groups":["Engineering","Project-Alpha"],"iat":1783364505,"iss":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:461aab9f-8f2b-3f0d-a858-9263474cce13","preferred_username":"alice_lead","scope":"profile email","sid":"pVBt6NSW5eeSxsqMros7P3gf","sub":"6b999d16-f5e5-4abd-a9f7-94a7ee89c01f","typ":"Bearer"}}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"a41868df-dff0-4c31-8eff-1f62ca3d2192","input":{"auth":{"identity":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783364565,"groups":["Engineering","Project-Alpha"],"iat":1783364505,"iss":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:461aab9f-8f2b-3f0d-a858-9263474cce13","preferred_username":"alice_lead","scope":"profile email","sid":"pVBt6NSW5eeSxsqMros7P3gf","sub":"6b999d16-f5e5-4abd-a9f7-94a7ee89c01f","typ":"Bearer"}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.44:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a41868df-dff0-4c31-8eff-1f62ca3d2192","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a41868df-dff0-4c31-8eff-1f62ca3d2192","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a41868df-dff0-4c31-8eff-1f62ca3d2192","config":{"Name":"oidc-groups-safe","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OPA":{"Rego":"unsafe_group[g] {\n\tg := input.auth.identity.groups[_]\n\tnot regex.match(\"^[A-Za-z0-9:._/-]+$\", g)\n}\n\nallow {\n\tcount(unsafe_group) == 0\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a41868df-dff0-4c31-8eff-1f62ca3d2192","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"a41868df-dff0-4c31-8eff-1f62ca3d2192","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a41868df-dff0-4c31-8eff-1f62ca3d2192","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a41868df-dff0-4c31-8eff-1f62ca3d2192","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"info","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a41868df-dff0-4c31-8eff-1f62ca3d2192","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a41868df-dff0-4c31-8eff-1f62ca3d2192","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e5266ea9-6817-4e88-ae01-2224dc78f710","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:59410","PortSpecifier":{"PortValue":59410}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"e5266ea9-6817-4e88-ae01-2224dc78f710","method":"DELETE","path":"/maas-api/v1/api-keys/beec8b74-4138-47e6-af94-855e8bcec0d1","host":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e5266ea9-6817-4e88-ae01-2224dc78f710","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:59410","PortSpecifier":{"PortValue":59410}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783364505,"nanos":698665938},"http":{"id":"e5266ea9-6817-4e88-ae01-2224dc78f710","method":"DELETE","headers":{":authority":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com",":method":"DELETE",":path":"/maas-api/v1/api-keys/beec8b74-4138-47e6-af94-855e8bcec0d1",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"e5266ea9-6817-4e88-ae01-2224dc78f710","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783364565,"groups":["Engineering","Project-Alpha"],"iat":1783364505,"iss":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:461aab9f-8f2b-3f0d-a858-9263474cce13","preferred_username":"alice_lead","scope":"profile email","sid":"pVBt6NSW5eeSxsqMros7P3gf","sub":"6b999d16-f5e5-4abd-a9f7-94a7ee89c01f","typ":"Bearer"}}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"e5266ea9-6817-4e88-ae01-2224dc78f710","input":{"auth":{"identity":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783364565,"groups":["Engineering","Project-Alpha"],"iat":1783364505,"iss":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:461aab9f-8f2b-3f0d-a858-9263474cce13","preferred_username":"alice_lead","scope":"profile email","sid":"pVBt6NSW5eeSxsqMros7P3gf","sub":"6b999d16-f5e5-4abd-a9f7-94a7ee89c01f","typ":"Bearer"}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.44:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com",":method":"DELETE",":path":"/maas-api/v1/api-keys/beec8b74-4138-47e6-af94-855e8bcec0d1",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e5266ea9-6817-4e88-ae01-2224dc78f710","config":{"Name":"oidc-groups-safe","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OPA":{"Rego":"unsafe_group[g] {\n\tg := input.auth.identity.groups[_]\n\tnot regex.match(\"^[A-Za-z0-9:._/-]+$\", g)\n}\n\nallow {\n\tcount(unsafe_group) == 0\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e5266ea9-6817-4e88-ae01-2224dc78f710","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e5266ea9-6817-4e88-ae01-2224dc78f710","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e5266ea9-6817-4e88-ae01-2224dc78f710","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"e5266ea9-6817-4e88-ae01-2224dc78f710","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e5266ea9-6817-4e88-ae01-2224dc78f710","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e5266ea9-6817-4e88-ae01-2224dc78f710","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"info","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e5266ea9-6817-4e88-ae01-2224dc78f710","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e5266ea9-6817-4e88-ae01-2224dc78f710","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"95087a46-a395-4061-beb8-d6d397ecc92c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:59414","PortSpecifier":{"PortValue":59414}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"95087a46-a395-4061-beb8-d6d397ecc92c","method":"GET","path":"/maas-api/v1/models","host":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"95087a46-a395-4061-beb8-d6d397ecc92c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:59414","PortSpecifier":{"PortValue":59414}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783364505,"nanos":734500688},"http":{"id":"95087a46-a395-4061-beb8-d6d397ecc92c","method":"GET","headers":{":authority":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"95087a46-a395-4061-beb8-d6d397ecc92c","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-sAKNFwQuwkTieGrM_U4uX7JCaSD17rz3aXFloCXen7quY6sAsTyj0Pue23Ub"}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"95087a46-a395-4061-beb8-d6d397ecc92c","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-sAKNFwQuwkTieGrM_U4uX7JCaSD17rz3aXFloCXen7quY6sAsTyj0Pue23Ub\"}"}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"95087a46-a395-4061-beb8-d6d397ecc92c","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"reason":"key revoked or expired","tenant":"","valid":false}}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"95087a46-a395-4061-beb8-d6d397ecc92c","input":{"auth":{"identity":"Bearer **** revoked or expired","tenant":"","valid":false}}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.44:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"95087a46-a395-4061-beb8-d6d397ecc92c","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access denied","request id":"95087a46-a395-4061-beb8-d6d397ecc92c","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"reason":"Unauthorized"}
{"level":"info","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"95087a46-a395-4061-beb8-d6d397ecc92c","authorized":false,"response":"PERMISSION_DENIED","object":{"code":7,"status":403,"message":"Unauthorized"}}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"95087a46-a395-4061-beb8-d6d397ecc92c","authorized":false,"response":"PERMISSION_DENIED","object":{"code":7,"status":403,"message":"Unauthorized","headers":[{"content-type":"text/plain"},{"x-ext-auth-reason":""}]}}
{"level":"info","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0d584e02-c8fc-4090-86b2-65dc39cf5fe5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:59418","PortSpecifier":{"PortValue":59418}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"0d584e02-c8fc-4090-86b2-65dc39cf5fe5","method":"GET","path":"/maas-api/v1/models","host":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0d584e02-c8fc-4090-86b2-65dc39cf5fe5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:59418","PortSpecifier":{"PortValue":59418}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783364505,"nanos":766100467},"http":{"id":"0d584e02-c8fc-4090-86b2-65dc39cf5fe5","method":"GET","headers":{":authority":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"0d584e02-c8fc-4090-86b2-65dc39cf5fe5","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-sAKNFwQuwkTieGrM_U4uX7JCaSD17rz3aXFloCXen7quY6sAsTyj0Pue23Ub"}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"0d584e02-c8fc-4090-86b2-65dc39cf5fe5","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-sAKNFwQuwkTieGrM_U4uX7JCaSD17rz3aXFloCXen7quY6sAsTyj0Pue23Ub\"}"}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"0d584e02-c8fc-4090-86b2-65dc39cf5fe5","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"reason":"key revoked or expired","tenant":"","valid":false}}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"0d584e02-c8fc-4090-86b2-65dc39cf5fe5","input":{"auth":{"identity":"Bearer **** revoked or expired","tenant":"","valid":false}}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.44:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0d584e02-c8fc-4090-86b2-65dc39cf5fe5","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access denied","request id":"0d584e02-c8fc-4090-86b2-65dc39cf5fe5","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"reason":"Unauthorized"}
{"level":"info","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0d584e02-c8fc-4090-86b2-65dc39cf5fe5","authorized":false,"response":"PERMISSION_DENIED","object":{"code":7,"status":403,"message":"Unauthorized"}}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0d584e02-c8fc-4090-86b2-65dc39cf5fe5","authorized":false,"response":"PERMISSION_DENIED","object":{"code":7,"status":403,"message":"Unauthorized","headers":[{"content-type":"text/plain"},{"x-ext-auth-reason":""}]}}
{"level":"info","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"56327328-2ed6-419a-adfe-3c710ad88bf2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:59430","PortSpecifier":{"PortValue":59430}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"56327328-2ed6-419a-adfe-3c710ad88bf2","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"56327328-2ed6-419a-adfe-3c710ad88bf2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:59430","PortSpecifier":{"PortValue":59430}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783364505,"nanos":892990364},"http":{"id":"56327328-2ed6-419a-adfe-3c710ad88bf2","method":"POST","headers":{":authority":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"56327328-2ed6-419a-adfe-3c710ad88bf2","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"56327328-2ed6-419a-adfe-3c710ad88bf2","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"56327328-2ed6-419a-adfe-3c710ad88bf2","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"not authenticated"}
{"level":"info","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"56327328-2ed6-419a-adfe-3c710ad88bf2","authorized":false,"response":"UNAUTHENTICATED","object":{"code":16,"status":401,"message":"Authentication required"}}
{"level":"debug","ts":"2026-07-06T19:01:45Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"56327328-2ed6-419a-adfe-3c710ad88bf2","authorized":false,"response":"UNAUTHENTICATED","object":{"code":16,"status":401,"message":"Authentication required","headers":[{"WWW-Authenticate":"request.headers.authorization realm=\"api-keys\""},{"WWW-Authenticate":"Bearer **** realm=\"openshift-identities\""}]}}
{"level":"info","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"df8d017a-82a2-4a07-94b3-1073ddb1501c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:59444","PortSpecifier":{"PortValue":59444}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"df8d017a-82a2-4a07-94b3-1073ddb1501c","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"df8d017a-82a2-4a07-94b3-1073ddb1501c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:59444","PortSpecifier":{"PortValue":59444}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783364506,"nanos":78194978},"http":{"id":"df8d017a-82a2-4a07-94b3-1073ddb1501c","method":"POST","headers":{":authority":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"df8d017a-82a2-4a07-94b3-1073ddb1501c","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783364565,"groups":["Engineering","Project-Alpha"],"iat":1783364505,"iss":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:efa45c5f-af5c-7fbc-a19b-9beaee492778","preferred_username":"alice_lead","scope":"profile email","sid":"a-MuI96cA5gmlf7Umin9SBgN","sub":"6b999d16-f5e5-4abd-a9f7-94a7ee89c01f","typ":"Bearer"}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"df8d017a-82a2-4a07-94b3-1073ddb1501c","input":{"auth":{"identity":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783364565,"groups":["Engineering","Project-Alpha"],"iat":1783364505,"iss":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:efa45c5f-af5c-7fbc-a19b-9beaee492778","preferred_username":"alice_lead","scope":"profile email","sid":"a-MuI96cA5gmlf7Umin9SBgN","sub":"6b999d16-f5e5-4abd-a9f7-94a7ee89c01f","typ":"Bearer"}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.44:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"df8d017a-82a2-4a07-94b3-1073ddb1501c","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"df8d017a-82a2-4a07-94b3-1073ddb1501c","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"df8d017a-82a2-4a07-94b3-1073ddb1501c","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"df8d017a-82a2-4a07-94b3-1073ddb1501c","config":{"Name":"oidc-groups-safe","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OPA":{"Rego":"unsafe_group[g] {\n\tg := input.auth.identity.groups[_]\n\tnot regex.match(\"^[A-Za-z0-9:._/-]+$\", g)\n}\n\nallow {\n\tcount(unsafe_group) == 0\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"df8d017a-82a2-4a07-94b3-1073ddb1501c","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"df8d017a-82a2-4a07-94b3-1073ddb1501c","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"df8d017a-82a2-4a07-94b3-1073ddb1501c","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"info","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"df8d017a-82a2-4a07-94b3-1073ddb1501c","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"df8d017a-82a2-4a07-94b3-1073ddb1501c","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9b3236a9-4d6d-42d9-be4f-67f2d3767f16","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:59450","PortSpecifier":{"PortValue":59450}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"9b3236a9-4d6d-42d9-be4f-67f2d3767f16","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9b3236a9-4d6d-42d9-be4f-67f2d3767f16","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:59450","PortSpecifier":{"PortValue":59450}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783364506,"nanos":109190509},"http":{"id":"9b3236a9-4d6d-42d9-be4f-67f2d3767f16","method":"POST","headers":{":authority":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"9b3236a9-4d6d-42d9-be4f-67f2d3767f16","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783364566,"groups":["Site-Reliability"],"iat":1783364506,"iss":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:3679c667-5b45-d414-b109-75c6c0348854","preferred_username":"bob_sre","scope":"profile email","sid":"gsLpknyalo-UJ18qPIQtnIor","sub":"fdf43355-8302-4a9a-9bcd-e7f0d0a3a147","typ":"Bearer"}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"9b3236a9-4d6d-42d9-be4f-67f2d3767f16","input":{"auth":{"identity":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783364566,"groups":["Site-Reliability"],"iat":1783364506,"iss":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:3679c667-5b45-d414-b109-75c6c0348854","preferred_username":"bob_sre","scope":"profile email","sid":"gsLpknyalo-UJ18qPIQtnIor","sub":"fdf43355-8302-4a9a-9bcd-e7f0d0a3a147","typ":"Bearer"}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.44:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9b3236a9-4d6d-42d9-be4f-67f2d3767f16","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9b3236a9-4d6d-42d9-be4f-67f2d3767f16","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9b3236a9-4d6d-42d9-be4f-67f2d3767f16","config":{"Name":"oidc-groups-safe","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OPA":{"Rego":"unsafe_group[g] {\n\tg := input.auth.identity.groups[_]\n\tnot regex.match(\"^[A-Za-z0-9:._/-]+$\", g)\n}\n\nallow {\n\tcount(unsafe_group) == 0\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9b3236a9-4d6d-42d9-be4f-67f2d3767f16","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"9b3236a9-4d6d-42d9-be4f-67f2d3767f16","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9b3236a9-4d6d-42d9-be4f-67f2d3767f16","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"bob_sre"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9b3236a9-4d6d-42d9-be4f-67f2d3767f16","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Site-Reliability\"]"}
{"level":"info","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9b3236a9-4d6d-42d9-be4f-67f2d3767f16","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9b3236a9-4d6d-42d9-be4f-67f2d3767f16","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"110ad181-56fd-4f0d-9f45-8b573b1dca5d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:59458","PortSpecifier":{"PortValue":59458}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"110ad181-56fd-4f0d-9f45-8b573b1dca5d","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"110ad181-56fd-4f0d-9f45-8b573b1dca5d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:59458","PortSpecifier":{"PortValue":59458}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783364506,"nanos":196720187},"http":{"id":"110ad181-56fd-4f0d-9f45-8b573b1dca5d","method":"POST","headers":{":authority":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"110ad181-56fd-4f0d-9f45-8b573b1dca5d","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783364566,"groups":["Engineering","Project-Alpha"],"iat":1783364506,"iss":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:106d5f97-8c72-cb39-d458-b9ed0fde79ce","preferred_username":"alice_lead","scope":"profile email","sid":"f-IBxNApnOYFzVL9L6QmRNyO","sub":"6b999d16-f5e5-4abd-a9f7-94a7ee89c01f","typ":"Bearer"}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"110ad181-56fd-4f0d-9f45-8b573b1dca5d","input":{"auth":{"identity":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783364566,"groups":["Engineering","Project-Alpha"],"iat":1783364506,"iss":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:106d5f97-8c72-cb39-d458-b9ed0fde79ce","preferred_username":"alice_lead","scope":"profile email","sid":"f-IBxNApnOYFzVL9L6QmRNyO","sub":"6b999d16-f5e5-4abd-a9f7-94a7ee89c01f","typ":"Bearer"}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.44:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"110ad181-56fd-4f0d-9f45-8b573b1dca5d","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"110ad181-56fd-4f0d-9f45-8b573b1dca5d","config":{"Name":"oidc-groups-safe","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OPA":{"Rego":"unsafe_group[g] {\n\tg := input.auth.identity.groups[_]\n\tnot regex.match(\"^[A-Za-z0-9:._/-]+$\", g)\n}\n\nallow {\n\tcount(unsafe_group) == 0\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"110ad181-56fd-4f0d-9f45-8b573b1dca5d","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"110ad181-56fd-4f0d-9f45-8b573b1dca5d","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"110ad181-56fd-4f0d-9f45-8b573b1dca5d","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"110ad181-56fd-4f0d-9f45-8b573b1dca5d","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"110ad181-56fd-4f0d-9f45-8b573b1dca5d","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"info","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"110ad181-56fd-4f0d-9f45-8b573b1dca5d","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"110ad181-56fd-4f0d-9f45-8b573b1dca5d","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5a01086f-eb15-489a-a42e-7c8887da78ca","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:59466","PortSpecifier":{"PortValue":59466}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"5a01086f-eb15-489a-a42e-7c8887da78ca","method":"DELETE","path":"/maas-api/v1/api-keys/c66a0032-2497-471d-bd41-140c6d921b9d","host":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5a01086f-eb15-489a-a42e-7c8887da78ca","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:59466","PortSpecifier":{"PortValue":59466}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783364506,"nanos":226015772},"http":{"id":"5a01086f-eb15-489a-a42e-7c8887da78ca","method":"DELETE","headers":{":authority":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com",":method":"DELETE",":path":"/maas-api/v1/api-keys/c66a0032-2497-471d-bd41-140c6d921b9d",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"5a01086f-eb15-489a-a42e-7c8887da78ca","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783364566,"groups":["Engineering","Project-Alpha"],"iat":1783364506,"iss":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:106d5f97-8c72-cb39-d458-b9ed0fde79ce","preferred_username":"alice_lead","scope":"profile email","sid":"f-IBxNApnOYFzVL9L6QmRNyO","sub":"6b999d16-f5e5-4abd-a9f7-94a7ee89c01f","typ":"Bearer"}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"5a01086f-eb15-489a-a42e-7c8887da78ca","input":{"auth":{"identity":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783364566,"groups":["Engineering","Project-Alpha"],"iat":1783364506,"iss":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:106d5f97-8c72-cb39-d458-b9ed0fde79ce","preferred_username":"alice_lead","scope":"profile email","sid":"f-IBxNApnOYFzVL9L6QmRNyO","sub":"6b999d16-f5e5-4abd-a9f7-94a7ee89c01f","typ":"Bearer"}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.44:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com",":method":"DELETE",":path":"/maas-api/v1/api-keys/c66a0032-2497-471d-bd41-140c6d921b9d",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5a01086f-eb15-489a-a42e-7c8887da78ca","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5a01086f-eb15-489a-a42e-7c8887da78ca","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5a01086f-eb15-489a-a42e-7c8887da78ca","config":{"Name":"oidc-groups-safe","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OPA":{"Rego":"unsafe_group[g] {\n\tg := input.auth.identity.groups[_]\n\tnot regex.match(\"^[A-Za-z0-9:._/-]+$\", g)\n}\n\nallow {\n\tcount(unsafe_group) == 0\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5a01086f-eb15-489a-a42e-7c8887da78ca","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"5a01086f-eb15-489a-a42e-7c8887da78ca","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5a01086f-eb15-489a-a42e-7c8887da78ca","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5a01086f-eb15-489a-a42e-7c8887da78ca","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"info","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5a01086f-eb15-489a-a42e-7c8887da78ca","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5a01086f-eb15-489a-a42e-7c8887da78ca","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"dac73979-b5a9-4003-8230-5b2e3d832893","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:59470","PortSpecifier":{"PortValue":59470}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"dac73979-b5a9-4003-8230-5b2e3d832893","method":"DELETE","path":"/maas-api/v1/api-keys/c66a0032-2497-471d-bd41-140c6d921b9d","host":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"dac73979-b5a9-4003-8230-5b2e3d832893","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:59470","PortSpecifier":{"PortValue":59470}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783364506,"nanos":261095979},"http":{"id":"dac73979-b5a9-4003-8230-5b2e3d832893","method":"DELETE","headers":{":authority":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com",":method":"DELETE",":path":"/maas-api/v1/api-keys/c66a0032-2497-471d-bd41-140c6d921b9d",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"dac73979-b5a9-4003-8230-5b2e3d832893","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783364566,"groups":["Engineering","Project-Alpha"],"iat":1783364506,"iss":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:106d5f97-8c72-cb39-d458-b9ed0fde79ce","preferred_username":"alice_lead","scope":"profile email","sid":"f-IBxNApnOYFzVL9L6QmRNyO","sub":"6b999d16-f5e5-4abd-a9f7-94a7ee89c01f","typ":"Bearer"}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"dac73979-b5a9-4003-8230-5b2e3d832893","input":{"auth":{"identity":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783364566,"groups":["Engineering","Project-Alpha"],"iat":1783364506,"iss":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:106d5f97-8c72-cb39-d458-b9ed0fde79ce","preferred_username":"alice_lead","scope":"profile email","sid":"f-IBxNApnOYFzVL9L6QmRNyO","sub":"6b999d16-f5e5-4abd-a9f7-94a7ee89c01f","typ":"Bearer"}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.44:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com",":method":"DELETE",":path":"/maas-api/v1/api-keys/c66a0032-2497-471d-bd41-140c6d921b9d",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"dac73979-b5a9-4003-8230-5b2e3d832893","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"dac73979-b5a9-4003-8230-5b2e3d832893","config":{"Name":"oidc-groups-safe","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OPA":{"Rego":"unsafe_group[g] {\n\tg := input.auth.identity.groups[_]\n\tnot regex.match(\"^[A-Za-z0-9:._/-]+$\", g)\n}\n\nallow {\n\tcount(unsafe_group) == 0\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"dac73979-b5a9-4003-8230-5b2e3d832893","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"dac73979-b5a9-4003-8230-5b2e3d832893","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"dac73979-b5a9-4003-8230-5b2e3d832893","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"dac73979-b5a9-4003-8230-5b2e3d832893","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"dac73979-b5a9-4003-8230-5b2e3d832893","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"info","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"dac73979-b5a9-4003-8230-5b2e3d832893","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"dac73979-b5a9-4003-8230-5b2e3d832893","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7f077843-063b-43a5-9474-b361ae966150","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:59484","PortSpecifier":{"PortValue":59484}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"7f077843-063b-43a5-9474-b361ae966150","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7f077843-063b-43a5-9474-b361ae966150","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:59484","PortSpecifier":{"PortValue":59484}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783364506,"nanos":355049385},"http":{"id":"7f077843-063b-43a5-9474-b361ae966150","method":"POST","headers":{":authority":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"7f077843-063b-43a5-9474-b361ae966150","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783364566,"groups":["Engineering","Project-Alpha"],"iat":1783364506,"iss":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:d58bf77a-e8e4-1f6b-f724-1a6f4b1768e4","preferred_username":"alice_lead","scope":"profile email","sid":"j8sZ6gc7-sqpgE4gvoyjZ6-M","sub":"6b999d16-f5e5-4abd-a9f7-94a7ee89c01f","typ":"Bearer"}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"7f077843-063b-43a5-9474-b361ae966150","input":{"auth":{"identity":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783364566,"groups":["Engineering","Project-Alpha"],"iat":1783364506,"iss":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:d58bf77a-e8e4-1f6b-f724-1a6f4b1768e4","preferred_username":"alice_lead","scope":"profile email","sid":"j8sZ6gc7-sqpgE4gvoyjZ6-M","sub":"6b999d16-f5e5-4abd-a9f7-94a7ee89c01f","typ":"Bearer"}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.44:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7f077843-063b-43a5-9474-b361ae966150","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7f077843-063b-43a5-9474-b361ae966150","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7f077843-063b-43a5-9474-b361ae966150","config":{"Name":"oidc-groups-safe","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OPA":{"Rego":"unsafe_group[g] {\n\tg := input.auth.identity.groups[_]\n\tnot regex.match(\"^[A-Za-z0-9:._/-]+$\", g)\n}\n\nallow {\n\tcount(unsafe_group) == 0\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7f077843-063b-43a5-9474-b361ae966150","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"7f077843-063b-43a5-9474-b361ae966150","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7f077843-063b-43a5-9474-b361ae966150","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7f077843-063b-43a5-9474-b361ae966150","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"info","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7f077843-063b-43a5-9474-b361ae966150","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7f077843-063b-43a5-9474-b361ae966150","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"414c489f-0eb5-463e-9051-8fdc2705e239","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:59496","PortSpecifier":{"PortValue":59496}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"414c489f-0eb5-463e-9051-8fdc2705e239","method":"GET","path":"/maas-api/v1/models","host":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"414c489f-0eb5-463e-9051-8fdc2705e239","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:59496","PortSpecifier":{"PortValue":59496}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783364506,"nanos":394992642},"http":{"id":"414c489f-0eb5-463e-9051-8fdc2705e239","method":"GET","headers":{":authority":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"414c489f-0eb5-463e-9051-8fdc2705e239","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1PE0DNNBE7bu43XkM_tkU9rxgBwUuGfvMUWeEnPeIqyAEsjo4gLPv6WYzCpUD"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"414c489f-0eb5-463e-9051-8fdc2705e239","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1PE0DNNBE7bu43XkM_tkU9rxgBwUuGfvMUWeEnPeIqyAEsjo4gLPv6WYzCpUD\"}"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"414c489f-0eb5-463e-9051-8fdc2705e239","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","Engineering","Project-Alpha"],"keyId":"94351f72-1a80-4716-92f6-2e2db1ff093c","keyName":"e2e-oidc-4ccbfda1","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"94351f72-1a80-4716-92f6-2e2db1ff093c","username":"alice_lead","valid":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"414c489f-0eb5-463e-9051-8fdc2705e239","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"414c489f-0eb5-463e-9051-8fdc2705e239","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"414c489f-0eb5-463e-9051-8fdc2705e239","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"414c489f-0eb5-463e-9051-8fdc2705e239","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"414c489f-0eb5-463e-9051-8fdc2705e239","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"414c489f-0eb5-463e-9051-8fdc2705e239","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"414c489f-0eb5-463e-9051-8fdc2705e239","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"414c489f-0eb5-463e-9051-8fdc2705e239","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"414c489f-0eb5-463e-9051-8fdc2705e239","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"414c489f-0eb5-463e-9051-8fdc2705e239","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"dcaf3ba0-ff59-4f46-84aa-8fd62afed374","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.33:51492","PortSpecifier":{"PortValue":51492}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"dcaf3ba0-ff59-4f46-84aa-8fd62afed374","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"dcaf3ba0-ff59-4f46-84aa-8fd62afed374","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.33:51492","PortSpecifier":{"PortValue":51492}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783364506,"nanos":404003221},"http":{"id":"dcaf3ba0-ff59-4f46-84aa-8fd62afed374","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"dcaf3ba0-ff59-4f46-84aa-8fd62afed374","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1PE0DNNBE7bu43XkM_tkU9rxgBwUuGfvMUWeEnPeIqyAEsjo4gLPv6WYzCpUD"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"dcaf3ba0-ff59-4f46-84aa-8fd62afed374","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1PE0DNNBE7bu43XkM_tkU9rxgBwUuGfvMUWeEnPeIqyAEsjo4gLPv6WYzCpUD\"}"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"dcaf3ba0-ff59-4f46-84aa-8fd62afed374","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","Engineering","Project-Alpha"],"keyId":"94351f72-1a80-4716-92f6-2e2db1ff093c","keyName":"e2e-oidc-4ccbfda1","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"94351f72-1a80-4716-92f6-2e2db1ff093c","username":"alice_lead","valid":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"dcaf3ba0-ff59-4f46-84aa-8fd62afed374","config":"subscription-info","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"],\"requestedModel\":\"llm/facebook-opt-125m-simulated\",\"requestedSubscription\":\"simulator-subscription\",\"username\":\"alice_lead\"}"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"dcaf3ba0-ff59-4f46-84aa-8fd62afed374","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"dcaf3ba0-ff59-4f46-84aa-8fd62afed374","input":{"auth":{"identity":"Bearer **** subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true}}},"context":{"context_extensions":{"host":"4375a0165d777c3dbcac3b90772aafb3ba82b742e01878423b9fb1e122337433"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.44:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** sk-oai-1PE0DNNBE7bu43XkM_tkU9rxgBwUuGfvMUWeEnPeIqyAEsjo4gLPv6WYzCpUD","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"facebook-opt-125m-simulated-kserve-workload-svc.llm.svc.cluster.local:8000/*","x-envoy-external-address":"10.133.0.33","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctcDVuYjQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.44~maas-default-gateway-openshift-default-56654dcf7-p5nb4.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.33","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"dcaf3ba0-ff59-4f46-84aa-8fd62afed374"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"dcaf3ba0-ff59-4f46-84aa-8fd62afed374","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":404003221,"seconds":1783364506},"url_path":"/llm/facebook-opt-125m-simulated/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.33:51492","port":51492}}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"dcaf3ba0-ff59-4f46-84aa-8fd62afed374","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"dcaf3ba0-ff59-4f46-84aa-8fd62afed374","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"dcaf3ba0-ff59-4f46-84aa-8fd62afed374","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"dcaf3ba0-ff59-4f46-84aa-8fd62afed374","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"dcaf3ba0-ff59-4f46-84aa-8fd62afed374","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"dcaf3ba0-ff59-4f46-84aa-8fd62afed374","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"dcaf3ba0-ff59-4f46-84aa-8fd62afed374","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"dcaf3ba0-ff59-4f46-84aa-8fd62afed374","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","Engineering","Project-Alpha"],"groups_str":"system:authenticated,Engineering,Project-Alpha","keyId":"94351f72-1a80-4716-92f6-2e2db1ff093c","keyName":"e2e-oidc-4ccbfda1","selected_subscription":"simulator-subscription","selected_subscription_key":"models-as-a-service/simulator-subscription@llm/facebook-opt-125m-simulated","subscription_error":"","subscription_error_message":"","subscription_info":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true},"userid":"alice_lead"}}
{"level":"info","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"dcaf3ba0-ff59-4f46-84aa-8fd62afed374","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"dcaf3ba0-ff59-4f46-84aa-8fd62afed374","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"03126a7c-9f2f-4704-a3ff-3b9a67e38a06","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:59506","PortSpecifier":{"PortValue":59506}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"03126a7c-9f2f-4704-a3ff-3b9a67e38a06","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"03126a7c-9f2f-4704-a3ff-3b9a67e38a06","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:59506","PortSpecifier":{"PortValue":59506}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783364506,"nanos":500830719},"http":{"id":"03126a7c-9f2f-4704-a3ff-3b9a67e38a06","method":"POST","headers":{":authority":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"03126a7c-9f2f-4704-a3ff-3b9a67e38a06","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783364566,"groups":["Engineering","Project-Alpha"],"iat":1783364506,"iss":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:db0baa81-e66c-316e-74ad-a33b77895df9","preferred_username":"alice_lead","scope":"profile email","sid":"cKK5JdQims4C8ggmnYzYCwZo","sub":"6b999d16-f5e5-4abd-a9f7-94a7ee89c01f","typ":"Bearer"}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"03126a7c-9f2f-4704-a3ff-3b9a67e38a06","input":{"auth":{"identity":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783364566,"groups":["Engineering","Project-Alpha"],"iat":1783364506,"iss":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:db0baa81-e66c-316e-74ad-a33b77895df9","preferred_username":"alice_lead","scope":"profile email","sid":"cKK5JdQims4C8ggmnYzYCwZo","sub":"6b999d16-f5e5-4abd-a9f7-94a7ee89c01f","typ":"Bearer"}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.44:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"03126a7c-9f2f-4704-a3ff-3b9a67e38a06","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"03126a7c-9f2f-4704-a3ff-3b9a67e38a06","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"03126a7c-9f2f-4704-a3ff-3b9a67e38a06","config":{"Name":"oidc-groups-safe","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OPA":{"Rego":"unsafe_group[g] {\n\tg := input.auth.identity.groups[_]\n\tnot regex.match(\"^[A-Za-z0-9:._/-]+$\", g)\n}\n\nallow {\n\tcount(unsafe_group) == 0\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"03126a7c-9f2f-4704-a3ff-3b9a67e38a06","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"03126a7c-9f2f-4704-a3ff-3b9a67e38a06","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"03126a7c-9f2f-4704-a3ff-3b9a67e38a06","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"03126a7c-9f2f-4704-a3ff-3b9a67e38a06","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"info","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"03126a7c-9f2f-4704-a3ff-3b9a67e38a06","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"03126a7c-9f2f-4704-a3ff-3b9a67e38a06","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"df49a58f-ffe7-4512-a7e6-46fc9d3c8559","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:59516","PortSpecifier":{"PortValue":59516}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"df49a58f-ffe7-4512-a7e6-46fc9d3c8559","method":"GET","path":"/maas-api/v1/models","host":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"df49a58f-ffe7-4512-a7e6-46fc9d3c8559","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:59516","PortSpecifier":{"PortValue":59516}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783364506,"nanos":531004154},"http":{"id":"df49a58f-ffe7-4512-a7e6-46fc9d3c8559","method":"GET","headers":{":authority":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"df49a58f-ffe7-4512-a7e6-46fc9d3c8559","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-KXW8JQUUb3HIFkj8_9uCGaDlrqdrqH5oWetS2tjMAEsCl6ggSugTuD6ViOg8"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"df49a58f-ffe7-4512-a7e6-46fc9d3c8559","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-KXW8JQUUb3HIFkj8_9uCGaDlrqdrqH5oWetS2tjMAEsCl6ggSugTuD6ViOg8\"}"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"df49a58f-ffe7-4512-a7e6-46fc9d3c8559","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","Engineering","Project-Alpha"],"keyId":"989d7ed0-d53c-4c9a-bd51-52b7da27ba9e","keyName":"e2e-oidc-b13e2aaa","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"989d7ed0-d53c-4c9a-bd51-52b7da27ba9e","username":"alice_lead","valid":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"df49a58f-ffe7-4512-a7e6-46fc9d3c8559","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"df49a58f-ffe7-4512-a7e6-46fc9d3c8559","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"df49a58f-ffe7-4512-a7e6-46fc9d3c8559","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"df49a58f-ffe7-4512-a7e6-46fc9d3c8559","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"df49a58f-ffe7-4512-a7e6-46fc9d3c8559","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"df49a58f-ffe7-4512-a7e6-46fc9d3c8559","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"df49a58f-ffe7-4512-a7e6-46fc9d3c8559","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"df49a58f-ffe7-4512-a7e6-46fc9d3c8559","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"info","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"df49a58f-ffe7-4512-a7e6-46fc9d3c8559","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"df49a58f-ffe7-4512-a7e6-46fc9d3c8559","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8f1208d3-f40f-4638-b04b-bb46b7538562","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:59526","PortSpecifier":{"PortValue":59526}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"8f1208d3-f40f-4638-b04b-bb46b7538562","method":"GET","path":"/maas-api/v1/models","host":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8f1208d3-f40f-4638-b04b-bb46b7538562","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:59526","PortSpecifier":{"PortValue":59526}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783364506,"nanos":556798220},"http":{"id":"8f1208d3-f40f-4638-b04b-bb46b7538562","method":"GET","headers":{":authority":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"8f1208d3-f40f-4638-b04b-bb46b7538562","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-KXW8JQUUb3HIFkj8_9uCGaDlrqdrqH5oWetS2tjMAEsCl6ggSugTuD6ViOg8"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"8f1208d3-f40f-4638-b04b-bb46b7538562","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-KXW8JQUUb3HIFkj8_9uCGaDlrqdrqH5oWetS2tjMAEsCl6ggSugTuD6ViOg8\"}"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"8f1208d3-f40f-4638-b04b-bb46b7538562","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","Engineering","Project-Alpha"],"keyId":"989d7ed0-d53c-4c9a-bd51-52b7da27ba9e","keyName":"e2e-oidc-b13e2aaa","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"989d7ed0-d53c-4c9a-bd51-52b7da27ba9e","username":"alice_lead","valid":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"8f1208d3-f40f-4638-b04b-bb46b7538562","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8f1208d3-f40f-4638-b04b-bb46b7538562","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8f1208d3-f40f-4638-b04b-bb46b7538562","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8f1208d3-f40f-4638-b04b-bb46b7538562","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8f1208d3-f40f-4638-b04b-bb46b7538562","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"8f1208d3-f40f-4638-b04b-bb46b7538562","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8f1208d3-f40f-4638-b04b-bb46b7538562","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8f1208d3-f40f-4638-b04b-bb46b7538562","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"info","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8f1208d3-f40f-4638-b04b-bb46b7538562","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8f1208d3-f40f-4638-b04b-bb46b7538562","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a60db3a2-9e2e-415c-a207-fb3440eafff7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.33:51492","PortSpecifier":{"PortValue":51492}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"a60db3a2-9e2e-415c-a207-fb3440eafff7","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a60db3a2-9e2e-415c-a207-fb3440eafff7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.33:51492","PortSpecifier":{"PortValue":51492}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783364506,"nanos":564778901},"http":{"id":"a60db3a2-9e2e-415c-a207-fb3440eafff7","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"a60db3a2-9e2e-415c-a207-fb3440eafff7","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-KXW8JQUUb3HIFkj8_9uCGaDlrqdrqH5oWetS2tjMAEsCl6ggSugTuD6ViOg8"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a60db3a2-9e2e-415c-a207-fb3440eafff7","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-KXW8JQUUb3HIFkj8_9uCGaDlrqdrqH5oWetS2tjMAEsCl6ggSugTuD6ViOg8\"}"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a60db3a2-9e2e-415c-a207-fb3440eafff7","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","Engineering","Project-Alpha"],"keyId":"989d7ed0-d53c-4c9a-bd51-52b7da27ba9e","keyName":"e2e-oidc-b13e2aaa","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"989d7ed0-d53c-4c9a-bd51-52b7da27ba9e","username":"alice_lead","valid":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a60db3a2-9e2e-415c-a207-fb3440eafff7","config":"subscription-info","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"],\"requestedModel\":\"llm/facebook-opt-125m-simulated\",\"requestedSubscription\":\"simulator-subscription\",\"username\":\"alice_lead\"}"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a60db3a2-9e2e-415c-a207-fb3440eafff7","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"a60db3a2-9e2e-415c-a207-fb3440eafff7","input":{"auth":{"identity":"Bearer **** subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true}}},"context":{"context_extensions":{"host":"4375a0165d777c3dbcac3b90772aafb3ba82b742e01878423b9fb1e122337433"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.44:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** sk-oai-KXW8JQUUb3HIFkj8_9uCGaDlrqdrqH5oWetS2tjMAEsCl6ggSugTuD6ViOg8","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"facebook-opt-125m-simulated-kserve-workload-svc.llm.svc.cluster.local:8000/*","x-envoy-external-address":"10.133.0.33","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctcDVuYjQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.44~maas-default-gateway-openshift-default-56654dcf7-p5nb4.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.33","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"a60db3a2-9e2e-415c-a207-fb3440eafff7"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"a60db3a2-9e2e-415c-a207-fb3440eafff7","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":564778901,"seconds":1783364506},"url_path":"/llm/facebook-opt-125m-simulated/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.33:51492","port":51492}}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a60db3a2-9e2e-415c-a207-fb3440eafff7","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a60db3a2-9e2e-415c-a207-fb3440eafff7","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a60db3a2-9e2e-415c-a207-fb3440eafff7","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a60db3a2-9e2e-415c-a207-fb3440eafff7","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a60db3a2-9e2e-415c-a207-fb3440eafff7","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a60db3a2-9e2e-415c-a207-fb3440eafff7","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a60db3a2-9e2e-415c-a207-fb3440eafff7","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a60db3a2-9e2e-415c-a207-fb3440eafff7","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","Engineering","Project-Alpha"],"groups_str":"system:authenticated,Engineering,Project-Alpha","keyId":"989d7ed0-d53c-4c9a-bd51-52b7da27ba9e","keyName":"e2e-oidc-b13e2aaa","selected_subscription":"simulator-subscription","selected_subscription_key":"models-as-a-service/simulator-subscription@llm/facebook-opt-125m-simulated","subscription_error":"","subscription_error_message":"","subscription_info":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true},"userid":"alice_lead"}}
{"level":"info","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a60db3a2-9e2e-415c-a207-fb3440eafff7","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a60db3a2-9e2e-415c-a207-fb3440eafff7","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"39c5ee53-718e-4589-aa6e-2080ac249a60","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:59538","PortSpecifier":{"PortValue":59538}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"39c5ee53-718e-4589-aa6e-2080ac249a60","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"39c5ee53-718e-4589-aa6e-2080ac249a60","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:59538","PortSpecifier":{"PortValue":59538}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783364506,"nanos":684157799},"http":{"id":"39c5ee53-718e-4589-aa6e-2080ac249a60","method":"POST","headers":{":authority":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"39c5ee53-718e-4589-aa6e-2080ac249a60","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783364566,"groups":["Engineering","Project-Alpha"],"iat":1783364506,"iss":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:e0623b83-328c-76b9-6d86-02ac6592b8a4","preferred_username":"alice_lead","scope":"profile email","sid":"IdJwN7IfGvJIU8Vk0FljEAgg","sub":"6b999d16-f5e5-4abd-a9f7-94a7ee89c01f","typ":"Bearer"}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"39c5ee53-718e-4589-aa6e-2080ac249a60","input":{"auth":{"identity":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783364566,"groups":["Engineering","Project-Alpha"],"iat":1783364506,"iss":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:e0623b83-328c-76b9-6d86-02ac6592b8a4","preferred_username":"alice_lead","scope":"profile email","sid":"IdJwN7IfGvJIU8Vk0FljEAgg","sub":"6b999d16-f5e5-4abd-a9f7-94a7ee89c01f","typ":"Bearer"}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.44:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"39c5ee53-718e-4589-aa6e-2080ac249a60","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"39c5ee53-718e-4589-aa6e-2080ac249a60","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"39c5ee53-718e-4589-aa6e-2080ac249a60","config":{"Name":"oidc-groups-safe","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OPA":{"Rego":"unsafe_group[g] {\n\tg := input.auth.identity.groups[_]\n\tnot regex.match(\"^[A-Za-z0-9:._/-]+$\", g)\n}\n\nallow {\n\tcount(unsafe_group) == 0\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"39c5ee53-718e-4589-aa6e-2080ac249a60","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"39c5ee53-718e-4589-aa6e-2080ac249a60","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"39c5ee53-718e-4589-aa6e-2080ac249a60","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"39c5ee53-718e-4589-aa6e-2080ac249a60","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"info","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"39c5ee53-718e-4589-aa6e-2080ac249a60","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"39c5ee53-718e-4589-aa6e-2080ac249a60","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"eddf4d18-34ae-4e93-ac04-3099c3e89b4c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:59554","PortSpecifier":{"PortValue":59554}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"eddf4d18-34ae-4e93-ac04-3099c3e89b4c","method":"GET","path":"/maas-api/v1/models","host":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"eddf4d18-34ae-4e93-ac04-3099c3e89b4c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:59554","PortSpecifier":{"PortValue":59554}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783364506,"nanos":722043425},"http":{"id":"eddf4d18-34ae-4e93-ac04-3099c3e89b4c","method":"GET","headers":{":authority":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"eddf4d18-34ae-4e93-ac04-3099c3e89b4c","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-XJ6sV9AYj4d2XFMa_VWUBKWOGL9UZVnkwEzqlc748gVgXsAKWW0hcdEVjdiy"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"eddf4d18-34ae-4e93-ac04-3099c3e89b4c","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-XJ6sV9AYj4d2XFMa_VWUBKWOGL9UZVnkwEzqlc748gVgXsAKWW0hcdEVjdiy\"}"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"eddf4d18-34ae-4e93-ac04-3099c3e89b4c","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","Engineering","Project-Alpha"],"keyId":"66e34f7a-d07a-4db9-93e6-25c1ea2f5ba0","keyName":"e2e-oidc-06507042","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"66e34f7a-d07a-4db9-93e6-25c1ea2f5ba0","username":"alice_lead","valid":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"eddf4d18-34ae-4e93-ac04-3099c3e89b4c","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"eddf4d18-34ae-4e93-ac04-3099c3e89b4c","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"eddf4d18-34ae-4e93-ac04-3099c3e89b4c","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"eddf4d18-34ae-4e93-ac04-3099c3e89b4c","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"eddf4d18-34ae-4e93-ac04-3099c3e89b4c","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"eddf4d18-34ae-4e93-ac04-3099c3e89b4c","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"eddf4d18-34ae-4e93-ac04-3099c3e89b4c","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"eddf4d18-34ae-4e93-ac04-3099c3e89b4c","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"info","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"eddf4d18-34ae-4e93-ac04-3099c3e89b4c","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"eddf4d18-34ae-4e93-ac04-3099c3e89b4c","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"caa98df5-ebf0-4b2b-99fd-c482f4c452db","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.33:51492","PortSpecifier":{"PortValue":51492}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"caa98df5-ebf0-4b2b-99fd-c482f4c452db","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"caa98df5-ebf0-4b2b-99fd-c482f4c452db","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.33:51492","PortSpecifier":{"PortValue":51492}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783364506,"nanos":730061917},"http":{"id":"caa98df5-ebf0-4b2b-99fd-c482f4c452db","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"caa98df5-ebf0-4b2b-99fd-c482f4c452db","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-XJ6sV9AYj4d2XFMa_VWUBKWOGL9UZVnkwEzqlc748gVgXsAKWW0hcdEVjdiy"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"caa98df5-ebf0-4b2b-99fd-c482f4c452db","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-XJ6sV9AYj4d2XFMa_VWUBKWOGL9UZVnkwEzqlc748gVgXsAKWW0hcdEVjdiy\"}"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"caa98df5-ebf0-4b2b-99fd-c482f4c452db","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","Engineering","Project-Alpha"],"keyId":"66e34f7a-d07a-4db9-93e6-25c1ea2f5ba0","keyName":"e2e-oidc-06507042","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"66e34f7a-d07a-4db9-93e6-25c1ea2f5ba0","username":"alice_lead","valid":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"caa98df5-ebf0-4b2b-99fd-c482f4c452db","config":"subscription-info","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"],\"requestedModel\":\"llm/facebook-opt-125m-simulated\",\"requestedSubscription\":\"simulator-subscription\",\"username\":\"alice_lead\"}"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"caa98df5-ebf0-4b2b-99fd-c482f4c452db","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"caa98df5-ebf0-4b2b-99fd-c482f4c452db","input":{"auth":{"identity":"Bearer **** subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true}}},"context":{"context_extensions":{"host":"4375a0165d777c3dbcac3b90772aafb3ba82b742e01878423b9fb1e122337433"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.44:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** sk-oai-XJ6sV9AYj4d2XFMa_VWUBKWOGL9UZVnkwEzqlc748gVgXsAKWW0hcdEVjdiy","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"facebook-opt-125m-simulated-kserve-workload-svc.llm.svc.cluster.local:8000/*","x-envoy-external-address":"10.133.0.33","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctcDVuYjQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.44~maas-default-gateway-openshift-default-56654dcf7-p5nb4.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.33","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"caa98df5-ebf0-4b2b-99fd-c482f4c452db"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"caa98df5-ebf0-4b2b-99fd-c482f4c452db","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":730061917,"seconds":1783364506},"url_path":"/llm/facebook-opt-125m-simulated/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.33:51492","port":51492}}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"caa98df5-ebf0-4b2b-99fd-c482f4c452db","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"caa98df5-ebf0-4b2b-99fd-c482f4c452db","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"caa98df5-ebf0-4b2b-99fd-c482f4c452db","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"caa98df5-ebf0-4b2b-99fd-c482f4c452db","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"caa98df5-ebf0-4b2b-99fd-c482f4c452db","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"caa98df5-ebf0-4b2b-99fd-c482f4c452db","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"caa98df5-ebf0-4b2b-99fd-c482f4c452db","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"caa98df5-ebf0-4b2b-99fd-c482f4c452db","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","Engineering","Project-Alpha"],"groups_str":"system:authenticated,Engineering,Project-Alpha","keyId":"66e34f7a-d07a-4db9-93e6-25c1ea2f5ba0","keyName":"e2e-oidc-06507042","selected_subscription":"simulator-subscription","selected_subscription_key":"models-as-a-service/simulator-subscription@llm/facebook-opt-125m-simulated","subscription_error":"","subscription_error_message":"","subscription_info":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true},"userid":"alice_lead"}}
{"level":"info","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"caa98df5-ebf0-4b2b-99fd-c482f4c452db","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"caa98df5-ebf0-4b2b-99fd-c482f4c452db","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"4e5e575e-c10a-429d-8934-580718e74cb5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:59564","PortSpecifier":{"PortValue":59564}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"4e5e575e-c10a-429d-8934-580718e74cb5","method":"GET","path":"/maas-api/v1/models","host":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"4e5e575e-c10a-429d-8934-580718e74cb5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:59564","PortSpecifier":{"PortValue":59564}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783364506,"nanos":763674194},"http":{"id":"4e5e575e-c10a-429d-8934-580718e74cb5","method":"GET","headers":{":authority":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com",":method":"GET",":path":"/maas-api/v1/models",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"4e5e575e-c10a-429d-8934-580718e74cb5","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-XJ6sV9AYj4d2XFMa_VWUBKWOGL9UZVnkwEzqlc748gVgXsAKWW0hcdEVjdiy"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"4e5e575e-c10a-429d-8934-580718e74cb5","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-XJ6sV9AYj4d2XFMa_VWUBKWOGL9UZVnkwEzqlc748gVgXsAKWW0hcdEVjdiy\"}"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"4e5e575e-c10a-429d-8934-580718e74cb5","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","Engineering","Project-Alpha"],"keyId":"66e34f7a-d07a-4db9-93e6-25c1ea2f5ba0","keyName":"e2e-oidc-06507042","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"66e34f7a-d07a-4db9-93e6-25c1ea2f5ba0","username":"alice_lead","valid":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"4e5e575e-c10a-429d-8934-580718e74cb5","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4e5e575e-c10a-429d-8934-580718e74cb5","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4e5e575e-c10a-429d-8934-580718e74cb5","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4e5e575e-c10a-429d-8934-580718e74cb5","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4e5e575e-c10a-429d-8934-580718e74cb5","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"4e5e575e-c10a-429d-8934-580718e74cb5","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4e5e575e-c10a-429d-8934-580718e74cb5","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4e5e575e-c10a-429d-8934-580718e74cb5","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"alice_lead"}
{"level":"info","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4e5e575e-c10a-429d-8934-580718e74cb5","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4e5e575e-c10a-429d-8934-580718e74cb5","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"47dea511-ce33-432c-a47a-b588e0565e00","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.33:51492","PortSpecifier":{"PortValue":51492}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"47dea511-ce33-432c-a47a-b588e0565e00","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"47dea511-ce33-432c-a47a-b588e0565e00","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.33:51492","PortSpecifier":{"PortValue":51492}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783364506,"nanos":771304644},"http":{"id":"47dea511-ce33-432c-a47a-b588e0565e00","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"47dea511-ce33-432c-a47a-b588e0565e00","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-XJ6sV9AYj4d2XFMa_VWUBKWOGL9UZVnkwEzqlc748gVgXsAKWW0hcdEVjdiy"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"47dea511-ce33-432c-a47a-b588e0565e00","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-XJ6sV9AYj4d2XFMa_VWUBKWOGL9UZVnkwEzqlc748gVgXsAKWW0hcdEVjdiy\"}"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"47dea511-ce33-432c-a47a-b588e0565e00","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","Engineering","Project-Alpha"],"keyId":"66e34f7a-d07a-4db9-93e6-25c1ea2f5ba0","keyName":"e2e-oidc-06507042","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"66e34f7a-d07a-4db9-93e6-25c1ea2f5ba0","username":"alice_lead","valid":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"47dea511-ce33-432c-a47a-b588e0565e00","config":"subscription-info","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"],\"requestedModel\":\"llm/facebook-opt-125m-simulated\",\"requestedSubscription\":\"simulator-subscription\",\"username\":\"alice_lead\"}"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"47dea511-ce33-432c-a47a-b588e0565e00","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"47dea511-ce33-432c-a47a-b588e0565e00","input":{"auth":{"identity":"Bearer **** subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true}}},"context":{"context_extensions":{"host":"4375a0165d777c3dbcac3b90772aafb3ba82b742e01878423b9fb1e122337433"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.44:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/llm/facebook-opt-125m-simulated/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer **** sk-oai-XJ6sV9AYj4d2XFMa_VWUBKWOGL9UZVnkwEzqlc748gVgXsAKWW0hcdEVjdiy","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"facebook-opt-125m-simulated-kserve-workload-svc.llm.svc.cluster.local:8000/*","x-envoy-external-address":"10.133.0.33","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctcDVuYjQKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.134.0.44~maas-default-gateway-openshift-default-56654dcf7-p5nb4.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.33","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"47dea511-ce33-432c-a47a-b588e0565e00"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"47dea511-ce33-432c-a47a-b588e0565e00","method":"GET","path":"/llm/facebook-opt-125m-simulated/v1/models","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":771304644,"seconds":1783364506},"url_path":"/llm/facebook-opt-125m-simulated/v1/models","user_agent":"Go-http-client/1.1"},"source":{"address":"10.133.0.33:51492","port":51492}}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"47dea511-ce33-432c-a47a-b588e0565e00","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"47dea511-ce33-432c-a47a-b588e0565e00","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"47dea511-ce33-432c-a47a-b588e0565e00","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"47dea511-ce33-432c-a47a-b588e0565e00","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"47dea511-ce33-432c-a47a-b588e0565e00","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"47dea511-ce33-432c-a47a-b588e0565e00","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"47dea511-ce33-432c-a47a-b588e0565e00","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"47dea511-ce33-432c-a47a-b588e0565e00","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","Engineering","Project-Alpha"],"groups_str":"system:authenticated,Engineering,Project-Alpha","keyId":"66e34f7a-d07a-4db9-93e6-25c1ea2f5ba0","keyName":"e2e-oidc-06507042","selected_subscription":"simulator-subscription","selected_subscription_key":"models-as-a-service/simulator-subscription@llm/facebook-opt-125m-simulated","subscription_error":"","subscription_error_message":"","subscription_info":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true},"userid":"alice_lead"}}
{"level":"info","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"47dea511-ce33-432c-a47a-b588e0565e00","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"47dea511-ce33-432c-a47a-b588e0565e00","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"fe654b35-9494-431a-ac06-9ae2770fc913","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:59574","PortSpecifier":{"PortValue":59574}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"fe654b35-9494-431a-ac06-9ae2770fc913","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"fe654b35-9494-431a-ac06-9ae2770fc913","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.9:59574","PortSpecifier":{"PortValue":59574}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783364506,"nanos":873455381},"http":{"id":"fe654b35-9494-431a-ac06-9ae2770fc913","method":"POST","headers":{":authority":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"fe654b35-9494-431a-ac06-9ae2770fc913","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783364566,"groups":["Engineering","Project-Alpha"],"iat":1783364506,"iss":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:181ae3d5-2793-3130-99fc-3cda726bcda1","preferred_username":"alice_lead","scope":"profile email","sid":"JKhXr7b-9m2L2SNek0wwfxBo","sub":"6b999d16-f5e5-4abd-a9f7-94a7ee89c01f","typ":"Bearer"}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"fe654b35-9494-431a-ac06-9ae2770fc913","input":{"auth":{"identity":{"acr":"1","allowed-origins":["*"],"azp":"test-client","email_verified":true,"exp":1783364566,"groups":["Engineering","Project-Alpha"],"iat":1783364506,"iss":"https://keycloak.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com/realms/tenant-a","jti":"onrtro:181ae3d5-2793-3130-99fc-3cda726bcda1","preferred_username":"alice_lead","scope":"profile email","sid":"JKhXr7b-9m2L2SNek0wwfxBo","sub":"6b999d16-f5e5-4abd-a9f7-94a7ee89c01f","typ":"Bearer"}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.44:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.4aff1190-26f3-4bdb-bbf6-6aa6542dfc28.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fe654b35-9494-431a-ac06-9ae2770fc913","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fe654b35-9494-431a-ac06-9ae2770fc913","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fe654b35-9494-431a-ac06-9ae2770fc913","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fe654b35-9494-431a-ac06-9ae2770fc913","config":{"Name":"oidc-groups-safe","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OPA":{"Rego":"unsafe_group[g] {\n\tg := input.auth.identity.groups[_]\n\tnot regex.match(\"^[A-Za-z0-9:._/-]+$\", g)\n}\n\nallow {\n\tcount(unsafe_group) == 0\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"fe654b35-9494-431a-ac06-9ae2770fc913","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"fe654b35-9494-431a-ac06-9ae2770fc913","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"alice_lead"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"fe654b35-9494-431a-ac06-9ae2770fc913","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"Engineering\",\"Project-Alpha\"]"}
{"level":"info","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"fe654b35-9494-431a-ac06-9ae2770fc913","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T19:01:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"fe654b35-9494-431a-ac06-9ae2770fc913","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T19:01:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/825b4e4809451f9debccbe1150b699f739c117934b0bf98871cc2a21cd18800d"}
{"level":"info","ts":"2026-07-06T19:01:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/86345123ead4f37c7ec089e50cf7cc6cbfc5de47b541dbabfaa88510bcb6732b"}
{"level":"info","ts":"2026-07-06T19:02:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/cbee4de24e7f52377467bc1c31e35371aa80bf91cd74077a1bc0ff135956cb05"}
{"level":"info","ts":"2026-07-06T19:02:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/eb2791bd549e8278812cf508beb14dde3010dd6c48eb99afe00a94c55d9ae82a"}