{"level":"debug","ts":"2026-07-18T14:18:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d21cf8cb9aea83173e55822919f9153e09a99a1878b155fe5dff03967c2427e7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-18T14:18:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a28f3c625572777a55dc35b5fbfdabe7caf80c83560491078fb7d22af286c7f6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-18T14:18:53Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-18T14:18:53Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-18T14:18:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d21cf8cb9aea83173e55822919f9153e09a99a1878b155fe5dff03967c2427e7"}
{"level":"info","ts":"2026-07-18T14:18:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a28f3c625572777a55dc35b5fbfdabe7caf80c83560491078fb7d22af286c7f6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-18T14:18:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c89a67cb33559e71a080fcaf010ba35280b59a50cfe905fa3ef5fe613286d6dd","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-18T14:18:53Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-18T14:18:53Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-18T14:18:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c89a67cb33559e71a080fcaf010ba35280b59a50cfe905fa3ef5fe613286d6dd","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-18T14:18:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a28f3c625572777a55dc35b5fbfdabe7caf80c83560491078fb7d22af286c7f6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-18T14:18:53Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-18T14:18:53Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-18T14:18:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a28f3c625572777a55dc35b5fbfdabe7caf80c83560491078fb7d22af286c7f6"}
{"level":"info","ts":"2026-07-18T14:18:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a28f3c625572777a55dc35b5fbfdabe7caf80c83560491078fb7d22af286c7f6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-18T14:18:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c89a67cb33559e71a080fcaf010ba35280b59a50cfe905fa3ef5fe613286d6dd","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-18T14:18:53Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-18T14:18:53Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-18T14:18:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c89a67cb33559e71a080fcaf010ba35280b59a50cfe905fa3ef5fe613286d6dd","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-18T14:18:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a28f3c625572777a55dc35b5fbfdabe7caf80c83560491078fb7d22af286c7f6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-18T14:18:53Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-18T14:18:53Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a28f3c625572777a55dc35b5fbfdabe7caf80c83560491078fb7d22af286c7f6"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-18T14:18:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c89a67cb33559e71a080fcaf010ba35280b59a50cfe905fa3ef5fe613286d6dd"}
{"level":"info","ts":"2026-07-18T14:18:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a28f3c625572777a55dc35b5fbfdabe7caf80c83560491078fb7d22af286c7f6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-18T14:18:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c89a67cb33559e71a080fcaf010ba35280b59a50cfe905fa3ef5fe613286d6dd","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-18T14:18:53Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-18T14:18:53Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["c89a67cb33559e71a080fcaf010ba35280b59a50cfe905fa3ef5fe613286d6dd"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-18T14:18:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c89a67cb33559e71a080fcaf010ba35280b59a50cfe905fa3ef5fe613286d6dd","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-18T14:18:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a28f3c625572777a55dc35b5fbfdabe7caf80c83560491078fb7d22af286c7f6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-18T14:18:53Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-18T14:18:53Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-18T14:18:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a28f3c625572777a55dc35b5fbfdabe7caf80c83560491078fb7d22af286c7f6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-18T14:18:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c89a67cb33559e71a080fcaf010ba35280b59a50cfe905fa3ef5fe613286d6dd","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-18T14:18:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a28f3c625572777a55dc35b5fbfdabe7caf80c83560491078fb7d22af286c7f6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-18T14:18:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a28f3c625572777a55dc35b5fbfdabe7caf80c83560491078fb7d22af286c7f6","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-18T14:18:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a28f3c625572777a55dc35b5fbfdabe7caf80c83560491078fb7d22af286c7f6"}
{"level":"debug","ts":"2026-07-18T14:18:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a28f3c625572777a55dc35b5fbfdabe7caf80c83560491078fb7d22af286c7f6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-18T14:18:53Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-18T14:18:53Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a28f3c625572777a55dc35b5fbfdabe7caf80c83560491078fb7d22af286c7f6"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-18T14:18:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a28f3c625572777a55dc35b5fbfdabe7caf80c83560491078fb7d22af286c7f6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-18T14:18:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d21cf8cb9aea83173e55822919f9153e09a99a1878b155fe5dff03967c2427e7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-18T14:18:53Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-18T14:18:53Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["d21cf8cb9aea83173e55822919f9153e09a99a1878b155fe5dff03967c2427e7"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-18T14:18:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d21cf8cb9aea83173e55822919f9153e09a99a1878b155fe5dff03967c2427e7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-18T14:18:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a28f3c625572777a55dc35b5fbfdabe7caf80c83560491078fb7d22af286c7f6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-18T14:18:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d21cf8cb9aea83173e55822919f9153e09a99a1878b155fe5dff03967c2427e7","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-18T14:18:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c89a67cb33559e71a080fcaf010ba35280b59a50cfe905fa3ef5fe613286d6dd"}
{"level":"info","ts":"2026-07-18T14:18:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a28f3c625572777a55dc35b5fbfdabe7caf80c83560491078fb7d22af286c7f6"}
{"level":"info","ts":"2026-07-18T14:18:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d21cf8cb9aea83173e55822919f9153e09a99a1878b155fe5dff03967c2427e7"}
{"level":"debug","ts":"2026-07-18T14:18:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7dbbdec4e3cb9a34886a9e998eddfe2e2c2fb1af5463b97754d06d85a0dbdc58","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-18T14:18:53Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-18T14:18:53Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-18T14:18:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7dbbdec4e3cb9a34886a9e998eddfe2e2c2fb1af5463b97754d06d85a0dbdc58","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-18T14:18:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8d2e50d08bcca580be072c53f24302921342a3a2a1fd4e0e0c2a8ed1371d5c7b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-18T14:18:53Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-18T14:18:53Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-18T14:18:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7dbbdec4e3cb9a34886a9e998eddfe2e2c2fb1af5463b97754d06d85a0dbdc58"}
{"level":"info","ts":"2026-07-18T14:18:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8d2e50d08bcca580be072c53f24302921342a3a2a1fd4e0e0c2a8ed1371d5c7b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-18T14:18:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7dbbdec4e3cb9a34886a9e998eddfe2e2c2fb1af5463b97754d06d85a0dbdc58","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-18T14:18:53Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-18T14:18:53Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["7dbbdec4e3cb9a34886a9e998eddfe2e2c2fb1af5463b97754d06d85a0dbdc58"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-18T14:18:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7dbbdec4e3cb9a34886a9e998eddfe2e2c2fb1af5463b97754d06d85a0dbdc58","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-18T14:18:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8d2e50d08bcca580be072c53f24302921342a3a2a1fd4e0e0c2a8ed1371d5c7b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-18T14:18:53Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-18T14:18:53Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-18T14:18:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8d2e50d08bcca580be072c53f24302921342a3a2a1fd4e0e0c2a8ed1371d5c7b"}
{"level":"info","ts":"2026-07-18T14:18:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8d2e50d08bcca580be072c53f24302921342a3a2a1fd4e0e0c2a8ed1371d5c7b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-18T14:18:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7dbbdec4e3cb9a34886a9e998eddfe2e2c2fb1af5463b97754d06d85a0dbdc58","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-18T14:18:53Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-18T14:18:53Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-18T14:18:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7dbbdec4e3cb9a34886a9e998eddfe2e2c2fb1af5463b97754d06d85a0dbdc58","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-18T14:18:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8d2e50d08bcca580be072c53f24302921342a3a2a1fd4e0e0c2a8ed1371d5c7b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-18T14:18:53Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-18T14:18:53Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["8d2e50d08bcca580be072c53f24302921342a3a2a1fd4e0e0c2a8ed1371d5c7b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-18T14:18:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7dbbdec4e3cb9a34886a9e998eddfe2e2c2fb1af5463b97754d06d85a0dbdc58"}
{"level":"info","ts":"2026-07-18T14:18:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8d2e50d08bcca580be072c53f24302921342a3a2a1fd4e0e0c2a8ed1371d5c7b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-18T14:18:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7dbbdec4e3cb9a34886a9e998eddfe2e2c2fb1af5463b97754d06d85a0dbdc58","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-18T14:18:53Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-18T14:18:53Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["7dbbdec4e3cb9a34886a9e998eddfe2e2c2fb1af5463b97754d06d85a0dbdc58"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-18T14:18:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7dbbdec4e3cb9a34886a9e998eddfe2e2c2fb1af5463b97754d06d85a0dbdc58","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-18T14:18:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8d2e50d08bcca580be072c53f24302921342a3a2a1fd4e0e0c2a8ed1371d5c7b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-18T14:18:53Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-18T14:18:53Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-18T14:18:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8d2e50d08bcca580be072c53f24302921342a3a2a1fd4e0e0c2a8ed1371d5c7b"}
{"level":"info","ts":"2026-07-18T14:18:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8d2e50d08bcca580be072c53f24302921342a3a2a1fd4e0e0c2a8ed1371d5c7b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-18T14:18:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7dbbdec4e3cb9a34886a9e998eddfe2e2c2fb1af5463b97754d06d85a0dbdc58","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-18T14:18:53Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-18T14:18:53Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-18T14:18:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7dbbdec4e3cb9a34886a9e998eddfe2e2c2fb1af5463b97754d06d85a0dbdc58"}
{"level":"info","ts":"2026-07-18T14:18:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7dbbdec4e3cb9a34886a9e998eddfe2e2c2fb1af5463b97754d06d85a0dbdc58","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-18T14:18:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c5e6840f7f8a2aeaefbcbd75059190c6e9595045e42d4804ade150978a143d02","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-18T14:18:53Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-18T14:18:53Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-18T14:18:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c5e6840f7f8a2aeaefbcbd75059190c6e9595045e42d4804ade150978a143d02","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-18T14:18:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8d2e50d08bcca580be072c53f24302921342a3a2a1fd4e0e0c2a8ed1371d5c7b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-18T14:18:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a54f9df8dcf4b060c56266a8069c0c4a43f94646f5ec3eefb312c0da3d62be75","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-18T14:18:53Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-18T14:18:53Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-18T14:18:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8d2e50d08bcca580be072c53f24302921342a3a2a1fd4e0e0c2a8ed1371d5c7b"}
{"level":"info","ts":"2026-07-18T14:18:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a54f9df8dcf4b060c56266a8069c0c4a43f94646f5ec3eefb312c0da3d62be75","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-18T14:18:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7dbbdec4e3cb9a34886a9e998eddfe2e2c2fb1af5463b97754d06d85a0dbdc58","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-18T14:18:53Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-18T14:18:53Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["7dbbdec4e3cb9a34886a9e998eddfe2e2c2fb1af5463b97754d06d85a0dbdc58"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-18T14:18:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7dbbdec4e3cb9a34886a9e998eddfe2e2c2fb1af5463b97754d06d85a0dbdc58","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-18T14:18:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9034307596e5bb82a70bad8e58726d21f1cb153b29ad1556d836c542afb461dc","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-18T14:18:53Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-18T14:18:53Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-18T14:18:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c5e6840f7f8a2aeaefbcbd75059190c6e9595045e42d4804ade150978a143d02"}
{"level":"info","ts":"2026-07-18T14:18:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9034307596e5bb82a70bad8e58726d21f1cb153b29ad1556d836c542afb461dc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-18T14:18:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c5e6840f7f8a2aeaefbcbd75059190c6e9595045e42d4804ade150978a143d02","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-18T14:18:53Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-18T14:18:53Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["c5e6840f7f8a2aeaefbcbd75059190c6e9595045e42d4804ade150978a143d02"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-18T14:18:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a54f9df8dcf4b060c56266a8069c0c4a43f94646f5ec3eefb312c0da3d62be75"}
{"level":"info","ts":"2026-07-18T14:18:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c5e6840f7f8a2aeaefbcbd75059190c6e9595045e42d4804ade150978a143d02","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-18T14:18:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8d2e50d08bcca580be072c53f24302921342a3a2a1fd4e0e0c2a8ed1371d5c7b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-18T14:18:53Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-18T14:18:53Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["8d2e50d08bcca580be072c53f24302921342a3a2a1fd4e0e0c2a8ed1371d5c7b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-18T14:18:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8d2e50d08bcca580be072c53f24302921342a3a2a1fd4e0e0c2a8ed1371d5c7b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-18T14:18:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a54f9df8dcf4b060c56266a8069c0c4a43f94646f5ec3eefb312c0da3d62be75","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-18T14:18:53Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-18T14:18:53Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a54f9df8dcf4b060c56266a8069c0c4a43f94646f5ec3eefb312c0da3d62be75"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-18T14:18:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a54f9df8dcf4b060c56266a8069c0c4a43f94646f5ec3eefb312c0da3d62be75","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-18T14:18:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7dbbdec4e3cb9a34886a9e998eddfe2e2c2fb1af5463b97754d06d85a0dbdc58","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-18T14:18:53Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-18T14:18:53Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-18T14:18:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7dbbdec4e3cb9a34886a9e998eddfe2e2c2fb1af5463b97754d06d85a0dbdc58"}
{"level":"info","ts":"2026-07-18T14:18:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7dbbdec4e3cb9a34886a9e998eddfe2e2c2fb1af5463b97754d06d85a0dbdc58","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-18T14:18:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9034307596e5bb82a70bad8e58726d21f1cb153b29ad1556d836c542afb461dc","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-18T14:18:53Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-18T14:18:53Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-18T14:18:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9034307596e5bb82a70bad8e58726d21f1cb153b29ad1556d836c542afb461dc","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-18T14:18:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9034307596e5bb82a70bad8e58726d21f1cb153b29ad1556d836c542afb461dc"}
{"level":"debug","ts":"2026-07-18T14:18:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c5e6840f7f8a2aeaefbcbd75059190c6e9595045e42d4804ade150978a143d02","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-18T14:18:53Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-18T14:18:53Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-18T14:18:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c5e6840f7f8a2aeaefbcbd75059190c6e9595045e42d4804ade150978a143d02","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-18T14:18:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8d2e50d08bcca580be072c53f24302921342a3a2a1fd4e0e0c2a8ed1371d5c7b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-18T14:18:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a54f9df8dcf4b060c56266a8069c0c4a43f94646f5ec3eefb312c0da3d62be75","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-18T14:18:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c0b0f173e6f98385f80f0d26d0106b0e0be5371e75876af54d1b45200d8ef4fe","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-18T14:18:53Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-18T14:18:53Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-18T14:18:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c5e6840f7f8a2aeaefbcbd75059190c6e9595045e42d4804ade150978a143d02"}
{"level":"info","ts":"2026-07-18T14:18:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c0b0f173e6f98385f80f0d26d0106b0e0be5371e75876af54d1b45200d8ef4fe","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-18T14:18:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7dbbdec4e3cb9a34886a9e998eddfe2e2c2fb1af5463b97754d06d85a0dbdc58","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-18T14:18:53Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-18T14:18:53Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["7dbbdec4e3cb9a34886a9e998eddfe2e2c2fb1af5463b97754d06d85a0dbdc58"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-18T14:18:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7dbbdec4e3cb9a34886a9e998eddfe2e2c2fb1af5463b97754d06d85a0dbdc58","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-18T14:18:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9034307596e5bb82a70bad8e58726d21f1cb153b29ad1556d836c542afb461dc","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-18T14:18:53Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-18T14:18:53Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["9034307596e5bb82a70bad8e58726d21f1cb153b29ad1556d836c542afb461dc"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-18T14:18:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8d2e50d08bcca580be072c53f24302921342a3a2a1fd4e0e0c2a8ed1371d5c7b"}
{"level":"info","ts":"2026-07-18T14:18:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a54f9df8dcf4b060c56266a8069c0c4a43f94646f5ec3eefb312c0da3d62be75"}
{"level":"info","ts":"2026-07-18T14:18:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9034307596e5bb82a70bad8e58726d21f1cb153b29ad1556d836c542afb461dc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-18T14:18:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c5e6840f7f8a2aeaefbcbd75059190c6e9595045e42d4804ade150978a143d02","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-18T14:18:53Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-18T14:18:53Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["c5e6840f7f8a2aeaefbcbd75059190c6e9595045e42d4804ade150978a143d02"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-18T14:18:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c0b0f173e6f98385f80f0d26d0106b0e0be5371e75876af54d1b45200d8ef4fe"}
{"level":"info","ts":"2026-07-18T14:18:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7dbbdec4e3cb9a34886a9e998eddfe2e2c2fb1af5463b97754d06d85a0dbdc58"}
{"level":"info","ts":"2026-07-18T14:18:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9034307596e5bb82a70bad8e58726d21f1cb153b29ad1556d836c542afb461dc"}
{"level":"info","ts":"2026-07-18T14:18:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c5e6840f7f8a2aeaefbcbd75059190c6e9595045e42d4804ade150978a143d02","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-18T14:18:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c0b0f173e6f98385f80f0d26d0106b0e0be5371e75876af54d1b45200d8ef4fe","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-18T14:18:53Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-18T14:18:53Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["c0b0f173e6f98385f80f0d26d0106b0e0be5371e75876af54d1b45200d8ef4fe"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-18T14:18:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c5e6840f7f8a2aeaefbcbd75059190c6e9595045e42d4804ade150978a143d02"}
{"level":"info","ts":"2026-07-18T14:18:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d0d33b0a7c5028335a83c16bae5e9fad490fa3cd938e7dd3d6a31ea57df13b32"}
{"level":"info","ts":"2026-07-18T14:18:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c0b0f173e6f98385f80f0d26d0106b0e0be5371e75876af54d1b45200d8ef4fe","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-18T14:18:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7dbbdec4e3cb9a34886a9e998eddfe2e2c2fb1af5463b97754d06d85a0dbdc58","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-18T14:18:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d0d33b0a7c5028335a83c16bae5e9fad490fa3cd938e7dd3d6a31ea57df13b32","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-18T14:18:53Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-18T14:18:53Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["d0d33b0a7c5028335a83c16bae5e9fad490fa3cd938e7dd3d6a31ea57df13b32"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-18T14:18:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/89531873a7370a885a34688433ed5e1e96e64d6218ab4dce3cde33eecf99353b"}
{"level":"info","ts":"2026-07-18T14:18:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c5e6840f7f8a2aeaefbcbd75059190c6e9595045e42d4804ade150978a143d02"}
{"level":"info","ts":"2026-07-18T14:18:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b72024bef510b195a99b27e547f63ee790ca630d8e300f860f27ed4250266ad3"}
{"level":"info","ts":"2026-07-18T14:18:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d0d33b0a7c5028335a83c16bae5e9fad490fa3cd938e7dd3d6a31ea57df13b32","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-18T14:18:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9034307596e5bb82a70bad8e58726d21f1cb153b29ad1556d836c542afb461dc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-18T14:18:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"89531873a7370a885a34688433ed5e1e96e64d6218ab4dce3cde33eecf99353b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-18T14:18:53Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-18T14:18:53Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["89531873a7370a885a34688433ed5e1e96e64d6218ab4dce3cde33eecf99353b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-18T14:18:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c0b0f173e6f98385f80f0d26d0106b0e0be5371e75876af54d1b45200d8ef4fe"}
{"level":"info","ts":"2026-07-18T14:18:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2c6426ed15db90cb8a3481a5ebc6c35b265f5d67ba1f7f32b18aaf4d3383abca"}
{"level":"info","ts":"2026-07-18T14:18:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"89531873a7370a885a34688433ed5e1e96e64d6218ab4dce3cde33eecf99353b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-18T14:18:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c5e6840f7f8a2aeaefbcbd75059190c6e9595045e42d4804ade150978a143d02","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-18T14:18:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b72024bef510b195a99b27e547f63ee790ca630d8e300f860f27ed4250266ad3","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-18T14:18:53Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-18T14:18:53Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["b72024bef510b195a99b27e547f63ee790ca630d8e300f860f27ed4250266ad3"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-18T14:18:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d43c7910f82cc00875764db3b37d582a6a576ef0ffd19c32da26281bdf98dcb2"}
{"level":"info","ts":"2026-07-18T14:18:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3e9a95d078a2e18d00feed8936feee975d4343af6768f5a2f4bcd4536c5816e5"}
{"level":"info","ts":"2026-07-18T14:18:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b72024bef510b195a99b27e547f63ee790ca630d8e300f860f27ed4250266ad3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-18T14:18:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c0b0f173e6f98385f80f0d26d0106b0e0be5371e75876af54d1b45200d8ef4fe","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-18T14:18:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2c6426ed15db90cb8a3481a5ebc6c35b265f5d67ba1f7f32b18aaf4d3383abca","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-18T14:18:53Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-18T14:18:53Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["2c6426ed15db90cb8a3481a5ebc6c35b265f5d67ba1f7f32b18aaf4d3383abca"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-18T14:18:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/da3580851057373fe12a7f462cf4c33856ac453b093e20b48f53a055f857a6ed"}
{"level":"info","ts":"2026-07-18T14:18:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d0d33b0a7c5028335a83c16bae5e9fad490fa3cd938e7dd3d6a31ea57df13b32"}
{"level":"info","ts":"2026-07-18T14:18:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/db90915d6fc00166fc00a8eebd28b13466b4de6c3507b478fe00ccd8abb8820c"}
{"level":"info","ts":"2026-07-18T14:18:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2c6426ed15db90cb8a3481a5ebc6c35b265f5d67ba1f7f32b18aaf4d3383abca","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-18T14:18:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d43c7910f82cc00875764db3b37d582a6a576ef0ffd19c32da26281bdf98dcb2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-18T14:18:54Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-18T14:18:54Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["d43c7910f82cc00875764db3b37d582a6a576ef0ffd19c32da26281bdf98dcb2"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-18T14:18:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/89531873a7370a885a34688433ed5e1e96e64d6218ab4dce3cde33eecf99353b"}
{"level":"info","ts":"2026-07-18T14:18:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b72024bef510b195a99b27e547f63ee790ca630d8e300f860f27ed4250266ad3"}
{"level":"info","ts":"2026-07-18T14:18:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d43c7910f82cc00875764db3b37d582a6a576ef0ffd19c32da26281bdf98dcb2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-18T14:18:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3e9a95d078a2e18d00feed8936feee975d4343af6768f5a2f4bcd4536c5816e5","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-18T14:18:54Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-18T14:18:54Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3e9a95d078a2e18d00feed8936feee975d4343af6768f5a2f4bcd4536c5816e5"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-18T14:18:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2c6426ed15db90cb8a3481a5ebc6c35b265f5d67ba1f7f32b18aaf4d3383abca"}
{"level":"info","ts":"2026-07-18T14:18:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d43c7910f82cc00875764db3b37d582a6a576ef0ffd19c32da26281bdf98dcb2"}
{"level":"info","ts":"2026-07-18T14:18:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3e9a95d078a2e18d00feed8936feee975d4343af6768f5a2f4bcd4536c5816e5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-18T14:18:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"da3580851057373fe12a7f462cf4c33856ac453b093e20b48f53a055f857a6ed","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-18T14:18:54Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-18T14:18:54Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["da3580851057373fe12a7f462cf4c33856ac453b093e20b48f53a055f857a6ed"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-18T14:18:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3e9a95d078a2e18d00feed8936feee975d4343af6768f5a2f4bcd4536c5816e5"}
{"level":"info","ts":"2026-07-18T14:18:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"da3580851057373fe12a7f462cf4c33856ac453b093e20b48f53a055f857a6ed","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-18T14:18:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d0d33b0a7c5028335a83c16bae5e9fad490fa3cd938e7dd3d6a31ea57df13b32","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-18T14:18:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"db90915d6fc00166fc00a8eebd28b13466b4de6c3507b478fe00ccd8abb8820c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-18T14:18:54Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-18T14:18:54Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["db90915d6fc00166fc00a8eebd28b13466b4de6c3507b478fe00ccd8abb8820c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-18T14:18:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/da3580851057373fe12a7f462cf4c33856ac453b093e20b48f53a055f857a6ed"}
{"level":"info","ts":"2026-07-18T14:18:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"db90915d6fc00166fc00a8eebd28b13466b4de6c3507b478fe00ccd8abb8820c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-18T14:18:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"89531873a7370a885a34688433ed5e1e96e64d6218ab4dce3cde33eecf99353b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-18T14:18:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b72024bef510b195a99b27e547f63ee790ca630d8e300f860f27ed4250266ad3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-18T14:18:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2c6426ed15db90cb8a3481a5ebc6c35b265f5d67ba1f7f32b18aaf4d3383abca","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-18T14:18:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d43c7910f82cc00875764db3b37d582a6a576ef0ffd19c32da26281bdf98dcb2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-18T14:18:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3e9a95d078a2e18d00feed8936feee975d4343af6768f5a2f4bcd4536c5816e5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-18T14:18:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"da3580851057373fe12a7f462cf4c33856ac453b093e20b48f53a055f857a6ed","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-18T14:18:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"db90915d6fc00166fc00a8eebd28b13466b4de6c3507b478fe00ccd8abb8820c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-18T14:18:54Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-18T14:18:54Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-18T14:18:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/db90915d6fc00166fc00a8eebd28b13466b4de6c3507b478fe00ccd8abb8820c"}
{"level":"info","ts":"2026-07-18T14:18:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"db90915d6fc00166fc00a8eebd28b13466b4de6c3507b478fe00ccd8abb8820c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-18T14:18:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"db90915d6fc00166fc00a8eebd28b13466b4de6c3507b478fe00ccd8abb8820c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-18T14:18:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"db90915d6fc00166fc00a8eebd28b13466b4de6c3507b478fe00ccd8abb8820c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-18T14:18:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"db90915d6fc00166fc00a8eebd28b13466b4de6c3507b478fe00ccd8abb8820c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-18T14:18:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/db90915d6fc00166fc00a8eebd28b13466b4de6c3507b478fe00ccd8abb8820c"}
{"level":"debug","ts":"2026-07-18T14:18:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"db90915d6fc00166fc00a8eebd28b13466b4de6c3507b478fe00ccd8abb8820c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-18T14:18:54Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-18T14:18:54Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["db90915d6fc00166fc00a8eebd28b13466b4de6c3507b478fe00ccd8abb8820c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-18T14:18:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"db90915d6fc00166fc00a8eebd28b13466b4de6c3507b478fe00ccd8abb8820c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-18T14:18:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"db90915d6fc00166fc00a8eebd28b13466b4de6c3507b478fe00ccd8abb8820c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-18T14:18:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/db90915d6fc00166fc00a8eebd28b13466b4de6c3507b478fe00ccd8abb8820c"}
{"level":"info","ts":"2026-07-18T14:18:56Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"4f475d16-3081-4be5-a61a-88afe22cd9b3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.15:44562","PortSpecifier":{"PortValue":44562}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.53:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"4f475d16-3081-4be5-a61a-88afe22cd9b3","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-1bdd6b.apps.39547b11-1d3e-4f10-b633-e0544002afe5.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-18T14:18:56Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"4f475d16-3081-4be5-a61a-88afe22cd9b3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.15:44562","PortSpecifier":{"PortValue":44562}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.53:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784384336,"nanos":246105186},"http":{"id":"4f475d16-3081-4be5-a61a-88afe22cd9b3","method":"POST","headers":{":authority":"e2e-shared-a-1bdd6b.apps.39547b11-1d3e-4f10-b633-e0544002afe5.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-18T14:18:56Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"4f475d16-3081-4be5-a61a-88afe22cd9b3","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-18T14:18:56Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"4f475d16-3081-4be5-a61a-88afe22cd9b3","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"174c3db5-da7e-4544-8493-dd58af408773","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=87c706e3-6d49-45e0-bcb3-84d2482f826a"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/e0544002afe5"]}}
{"level":"debug","ts":"2026-07-18T14:18:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"4f475d16-3081-4be5-a61a-88afe22cd9b3","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/e0544002afe5"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=87c706e3-6d49-45e0-bcb3-84d2482f826a"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"174c3db5-da7e-4544-8493-dd58af408773","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"6222ae8aeb4fe1702808149bc6eef36dfbb57982fe7a13b30a8987cd0442664a"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.53:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-1bdd6b.apps.39547b11-1d3e-4f10-b633-e0544002afe5.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-18T14:18:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4f475d16-3081-4be5-a61a-88afe22cd9b3","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-18T14:18:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4f475d16-3081-4be5-a61a-88afe22cd9b3","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-18T14:18:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4f475d16-3081-4be5-a61a-88afe22cd9b3","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-1bdd6b/rate-test-model-1bdd6b\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-1bdd6b/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-18T14:18:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"4f475d16-3081-4be5-a61a-88afe22cd9b3","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-18T14:18:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4f475d16-3081-4be5-a61a-88afe22cd9b3","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-18T14:18:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4f475d16-3081-4be5-a61a-88afe22cd9b3","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-18T14:18:56Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4f475d16-3081-4be5-a61a-88afe22cd9b3","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-18T14:18:56Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4f475d16-3081-4be5-a61a-88afe22cd9b3","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-18T14:18:56Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"43a4de7d-2822-4f5f-b232-a4a0e0f28c15","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.15:50410","PortSpecifier":{"PortValue":50410}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.66:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"43a4de7d-2822-4f5f-b232-a4a0e0f28c15","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-66d5d1.apps.39547b11-1d3e-4f10-b633-e0544002afe5.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-18T14:18:56Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"43a4de7d-2822-4f5f-b232-a4a0e0f28c15","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.15:50410","PortSpecifier":{"PortValue":50410}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.66:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784384336,"nanos":285189945},"http":{"id":"43a4de7d-2822-4f5f-b232-a4a0e0f28c15","method":"POST","headers":{":authority":"e2e-shared-b-66d5d1.apps.39547b11-1d3e-4f10-b633-e0544002afe5.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-18T14:18:56Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"43a4de7d-2822-4f5f-b232-a4a0e0f28c15","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-18T14:18:56Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"43a4de7d-2822-4f5f-b232-a4a0e0f28c15","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"174c3db5-da7e-4544-8493-dd58af408773","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=87c706e3-6d49-45e0-bcb3-84d2482f826a"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/e0544002afe5"]}}
{"level":"debug","ts":"2026-07-18T14:18:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"43a4de7d-2822-4f5f-b232-a4a0e0f28c15","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/e0544002afe5"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=87c706e3-6d49-45e0-bcb3-84d2482f826a"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"174c3db5-da7e-4544-8493-dd58af408773","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"22e733782d005d6d450a45a4df0aede3b225b6a61d8ecad3f01cdce4c66611da"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.66:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-66d5d1.apps.39547b11-1d3e-4f10-b633-e0544002afe5.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-18T14:18:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"43a4de7d-2822-4f5f-b232-a4a0e0f28c15","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-18T14:18:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"43a4de7d-2822-4f5f-b232-a4a0e0f28c15","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-18T14:18:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"43a4de7d-2822-4f5f-b232-a4a0e0f28c15","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-66d5d1/rate-test-model-66d5d1\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-66d5d1/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-18T14:18:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"43a4de7d-2822-4f5f-b232-a4a0e0f28c15","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-18T14:18:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"43a4de7d-2822-4f5f-b232-a4a0e0f28c15","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-18T14:18:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"43a4de7d-2822-4f5f-b232-a4a0e0f28c15","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-18T14:18:56Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"43a4de7d-2822-4f5f-b232-a4a0e0f28c15","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-18T14:18:56Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"43a4de7d-2822-4f5f-b232-a4a0e0f28c15","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-18T14:18:56Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c22027a7-8e99-4530-b0c5-aa27f0b5108a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.15:44568","PortSpecifier":{"PortValue":44568}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.53:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"c22027a7-8e99-4530-b0c5-aa27f0b5108a","method":"POST","path":"/ai-tenant-e2e-shared-a-1bdd6b/rate-test-model-1bdd6b/v1/completions","host":"e2e-shared-a-1bdd6b.apps.39547b11-1d3e-4f10-b633-e0544002afe5.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-18T14:18:56Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c22027a7-8e99-4530-b0c5-aa27f0b5108a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.15:44568","PortSpecifier":{"PortValue":44568}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.53:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784384336,"nanos":321661580},"http":{"id":"c22027a7-8e99-4530-b0c5-aa27f0b5108a","method":"POST","headers":{":authority":"e2e-shared-a-1bdd6b.apps.39547b11-1d3e-4f10-b633-e0544002afe5.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-1bdd6b/rate-test-model-1bdd6b/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-18T14:18:56Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"c22027a7-8e99-4530-b0c5-aa27f0b5108a","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1SwWDQobteokrxSuN_hbGrqHMS6wc4LkRh4bhFwsWWq36PATWmDcyrvsj5CVL"}
{"level":"debug","ts":"2026-07-18T14:18:56Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"c22027a7-8e99-4530-b0c5-aa27f0b5108a","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-1bdd6b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1SwWDQobteokrxSuN_hbGrqHMS6wc4LkRh4bhFwsWWq36PATWmDcyrvsj5CVL\"}"}
{"level":"debug","ts":"2026-07-18T14:18:56Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"c22027a7-8e99-4530-b0c5-aa27f0b5108a","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1bdd6b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"af3e0afb-f571-43b9-ae12-790c49e172d2","keyName":"e2e-rate-a-1561b1","subscription":"e2e-rate-iso-a-1561b1","tenant":"e2e-shared-a-1bdd6b","userId":"af3e0afb-f571-43b9-ae12-790c49e172d2","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-18T14:18:56Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"c22027a7-8e99-4530-b0c5-aa27f0b5108a","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-1bdd6b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-1bdd6b/rate-test-model-1bdd6b\",\"requestedSubscription\":\"e2e-rate-iso-a-1561b1\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-18T14:18:56Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"c22027a7-8e99-4530-b0c5-aa27f0b5108a","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1bdd6b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-1bdd6b","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-1561b1","namespace":"ai-tenant-e2e-shared-a-1bdd6b","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-1bdd6b/rate-test-model-1bdd6b"}}
{"level":"debug","ts":"2026-07-18T14:18:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"c22027a7-8e99-4530-b0c5-aa27f0b5108a","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-18T14:18:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c22027a7-8e99-4530-b0c5-aa27f0b5108a","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-18T14:18:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c22027a7-8e99-4530-b0c5-aa27f0b5108a","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-18T14:18:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c22027a7-8e99-4530-b0c5-aa27f0b5108a","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-18T14:18:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c22027a7-8e99-4530-b0c5-aa27f0b5108a","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-1bdd6b/rate-test-model-1bdd6b\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-1bdd6b/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-18T14:18:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c22027a7-8e99-4530-b0c5-aa27f0b5108a","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-18T14:18:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c22027a7-8e99-4530-b0c5-aa27f0b5108a","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-18T14:18:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c22027a7-8e99-4530-b0c5-aa27f0b5108a","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-1561b1"}
{"level":"debug","ts":"2026-07-18T14:18:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c22027a7-8e99-4530-b0c5-aa27f0b5108a","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"af3e0afb-f571-43b9-ae12-790c49e172d2","keyName":"e2e-rate-a-1561b1","selected_subscription":"e2e-rate-iso-a-1561b1","selected_subscription_key":"ai-tenant-e2e-shared-a-1bdd6b/e2e-rate-iso-a-1561b1@ai-tenant-e2e-shared-a-1bdd6b/rate-test-model-1bdd6b","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-1bdd6b","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-1561b1","namespace":"ai-tenant-e2e-shared-a-1bdd6b","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-1bdd6b/rate-test-model-1bdd6b"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-18T14:18:56Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c22027a7-8e99-4530-b0c5-aa27f0b5108a","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-18T14:18:56Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c22027a7-8e99-4530-b0c5-aa27f0b5108a","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-18T14:18:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"842c063a-246f-4f99-bf44-777820e29fce","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.15:44580","PortSpecifier":{"PortValue":44580}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.53:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"842c063a-246f-4f99-bf44-777820e29fce","method":"POST","path":"/ai-tenant-e2e-shared-a-1bdd6b/rate-test-model-1bdd6b/v1/completions","host":"e2e-shared-a-1bdd6b.apps.39547b11-1d3e-4f10-b633-e0544002afe5.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-18T14:18:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"842c063a-246f-4f99-bf44-777820e29fce","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.15:44580","PortSpecifier":{"PortValue":44580}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.53:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784384337,"nanos":382089152},"http":{"id":"842c063a-246f-4f99-bf44-777820e29fce","method":"POST","headers":{":authority":"e2e-shared-a-1bdd6b.apps.39547b11-1d3e-4f10-b633-e0544002afe5.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-1bdd6b/rate-test-model-1bdd6b/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-18T14:18:57Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"842c063a-246f-4f99-bf44-777820e29fce","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1SwWDQobteokrxSuN_hbGrqHMS6wc4LkRh4bhFwsWWq36PATWmDcyrvsj5CVL"}
{"level":"debug","ts":"2026-07-18T14:18:57Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"842c063a-246f-4f99-bf44-777820e29fce","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-1bdd6b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1SwWDQobteokrxSuN_hbGrqHMS6wc4LkRh4bhFwsWWq36PATWmDcyrvsj5CVL\"}"}
{"level":"debug","ts":"2026-07-18T14:18:57Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"842c063a-246f-4f99-bf44-777820e29fce","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1bdd6b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"af3e0afb-f571-43b9-ae12-790c49e172d2","keyName":"e2e-rate-a-1561b1","subscription":"e2e-rate-iso-a-1561b1","tenant":"e2e-shared-a-1bdd6b","userId":"af3e0afb-f571-43b9-ae12-790c49e172d2","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-18T14:18:57Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"842c063a-246f-4f99-bf44-777820e29fce","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-1bdd6b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-1bdd6b/rate-test-model-1bdd6b\",\"requestedSubscription\":\"e2e-rate-iso-a-1561b1\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-18T14:18:57Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"842c063a-246f-4f99-bf44-777820e29fce","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1bdd6b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-1bdd6b","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-1561b1","namespace":"ai-tenant-e2e-shared-a-1bdd6b","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-1bdd6b/rate-test-model-1bdd6b"}}
{"level":"debug","ts":"2026-07-18T14:18:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"842c063a-246f-4f99-bf44-777820e29fce","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-18T14:18:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"842c063a-246f-4f99-bf44-777820e29fce","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-18T14:18:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"842c063a-246f-4f99-bf44-777820e29fce","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-18T14:18:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"842c063a-246f-4f99-bf44-777820e29fce","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-1bdd6b/rate-test-model-1bdd6b\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-1bdd6b/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-18T14:18:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"842c063a-246f-4f99-bf44-777820e29fce","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-18T14:18:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"842c063a-246f-4f99-bf44-777820e29fce","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-18T14:18:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"842c063a-246f-4f99-bf44-777820e29fce","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-18T14:18:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"842c063a-246f-4f99-bf44-777820e29fce","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-1561b1"}
{"level":"debug","ts":"2026-07-18T14:18:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"842c063a-246f-4f99-bf44-777820e29fce","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"af3e0afb-f571-43b9-ae12-790c49e172d2","keyName":"e2e-rate-a-1561b1","selected_subscription":"e2e-rate-iso-a-1561b1","selected_subscription_key":"ai-tenant-e2e-shared-a-1bdd6b/e2e-rate-iso-a-1561b1@ai-tenant-e2e-shared-a-1bdd6b/rate-test-model-1bdd6b","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-1bdd6b","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-1561b1","namespace":"ai-tenant-e2e-shared-a-1bdd6b","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-1bdd6b/rate-test-model-1bdd6b"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-18T14:18:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"842c063a-246f-4f99-bf44-777820e29fce","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-18T14:18:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"842c063a-246f-4f99-bf44-777820e29fce","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-18T14:18:58Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"76e81d6d-bfe1-485c-93c8-1bcda16d24fc","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.15:51338","PortSpecifier":{"PortValue":51338}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.53:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"76e81d6d-bfe1-485c-93c8-1bcda16d24fc","method":"POST","path":"/ai-tenant-e2e-shared-a-1bdd6b/rate-test-model-1bdd6b/v1/completions","host":"e2e-shared-a-1bdd6b.apps.39547b11-1d3e-4f10-b633-e0544002afe5.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-18T14:18:58Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"76e81d6d-bfe1-485c-93c8-1bcda16d24fc","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.15:51338","PortSpecifier":{"PortValue":51338}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.53:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784384338,"nanos":417955235},"http":{"id":"76e81d6d-bfe1-485c-93c8-1bcda16d24fc","method":"POST","headers":{":authority":"e2e-shared-a-1bdd6b.apps.39547b11-1d3e-4f10-b633-e0544002afe5.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-1bdd6b/rate-test-model-1bdd6b/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-18T14:18:58Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"76e81d6d-bfe1-485c-93c8-1bcda16d24fc","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1SwWDQobteokrxSuN_hbGrqHMS6wc4LkRh4bhFwsWWq36PATWmDcyrvsj5CVL"}
{"level":"debug","ts":"2026-07-18T14:18:58Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"76e81d6d-bfe1-485c-93c8-1bcda16d24fc","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-1bdd6b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1SwWDQobteokrxSuN_hbGrqHMS6wc4LkRh4bhFwsWWq36PATWmDcyrvsj5CVL\"}"}
{"level":"debug","ts":"2026-07-18T14:18:58Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"76e81d6d-bfe1-485c-93c8-1bcda16d24fc","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1bdd6b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"af3e0afb-f571-43b9-ae12-790c49e172d2","keyName":"e2e-rate-a-1561b1","subscription":"e2e-rate-iso-a-1561b1","tenant":"e2e-shared-a-1bdd6b","userId":"af3e0afb-f571-43b9-ae12-790c49e172d2","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-18T14:18:58Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"76e81d6d-bfe1-485c-93c8-1bcda16d24fc","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-1bdd6b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-1bdd6b/rate-test-model-1bdd6b\",\"requestedSubscription\":\"e2e-rate-iso-a-1561b1\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-18T14:18:58Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"76e81d6d-bfe1-485c-93c8-1bcda16d24fc","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1bdd6b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-1bdd6b","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-1561b1","namespace":"ai-tenant-e2e-shared-a-1bdd6b","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-1bdd6b/rate-test-model-1bdd6b"}}
{"level":"debug","ts":"2026-07-18T14:18:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"76e81d6d-bfe1-485c-93c8-1bcda16d24fc","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-18T14:18:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"76e81d6d-bfe1-485c-93c8-1bcda16d24fc","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-18T14:18:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"76e81d6d-bfe1-485c-93c8-1bcda16d24fc","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-18T14:18:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"76e81d6d-bfe1-485c-93c8-1bcda16d24fc","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-18T14:18:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"76e81d6d-bfe1-485c-93c8-1bcda16d24fc","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-1bdd6b/rate-test-model-1bdd6b\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-1bdd6b/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-18T14:18:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"76e81d6d-bfe1-485c-93c8-1bcda16d24fc","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-1561b1"}
{"level":"debug","ts":"2026-07-18T14:18:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"76e81d6d-bfe1-485c-93c8-1bcda16d24fc","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-18T14:18:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"76e81d6d-bfe1-485c-93c8-1bcda16d24fc","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-18T14:18:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"76e81d6d-bfe1-485c-93c8-1bcda16d24fc","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"af3e0afb-f571-43b9-ae12-790c49e172d2","keyName":"e2e-rate-a-1561b1","selected_subscription":"e2e-rate-iso-a-1561b1","selected_subscription_key":"ai-tenant-e2e-shared-a-1bdd6b/e2e-rate-iso-a-1561b1@ai-tenant-e2e-shared-a-1bdd6b/rate-test-model-1bdd6b","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-1bdd6b","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-1561b1","namespace":"ai-tenant-e2e-shared-a-1bdd6b","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-1bdd6b/rate-test-model-1bdd6b"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-18T14:18:58Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"76e81d6d-bfe1-485c-93c8-1bcda16d24fc","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-18T14:18:58Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"76e81d6d-bfe1-485c-93c8-1bcda16d24fc","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-18T14:19:06Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"49f60505-7dda-40c2-85f4-ba09ecb9215c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.15:51342","PortSpecifier":{"PortValue":51342}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.53:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"49f60505-7dda-40c2-85f4-ba09ecb9215c","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-1bdd6b.apps.39547b11-1d3e-4f10-b633-e0544002afe5.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-18T14:19:06Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"49f60505-7dda-40c2-85f4-ba09ecb9215c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.15:51342","PortSpecifier":{"PortValue":51342}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.53:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784384346,"nanos":927110674},"http":{"id":"49f60505-7dda-40c2-85f4-ba09ecb9215c","method":"POST","headers":{":authority":"e2e-shared-a-1bdd6b.apps.39547b11-1d3e-4f10-b633-e0544002afe5.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-18T14:19:06Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"49f60505-7dda-40c2-85f4-ba09ecb9215c","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-18T14:19:06Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"49f60505-7dda-40c2-85f4-ba09ecb9215c","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"174c3db5-da7e-4544-8493-dd58af408773","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=87c706e3-6d49-45e0-bcb3-84d2482f826a"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/e0544002afe5"]}}
{"level":"debug","ts":"2026-07-18T14:19:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"49f60505-7dda-40c2-85f4-ba09ecb9215c","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/e0544002afe5"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=87c706e3-6d49-45e0-bcb3-84d2482f826a"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"174c3db5-da7e-4544-8493-dd58af408773","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"6222ae8aeb4fe1702808149bc6eef36dfbb57982fe7a13b30a8987cd0442664a"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.53:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-1bdd6b.apps.39547b11-1d3e-4f10-b633-e0544002afe5.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-18T14:19:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"49f60505-7dda-40c2-85f4-ba09ecb9215c","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-18T14:19:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"49f60505-7dda-40c2-85f4-ba09ecb9215c","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-18T14:19:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"49f60505-7dda-40c2-85f4-ba09ecb9215c","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-1bdd6b/rate-test-model-1bdd6b\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-1bdd6b/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-18T14:19:06Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"49f60505-7dda-40c2-85f4-ba09ecb9215c","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-18T14:19:06Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"49f60505-7dda-40c2-85f4-ba09ecb9215c","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-18T14:19:06Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"49f60505-7dda-40c2-85f4-ba09ecb9215c","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-18T14:19:06Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"49f60505-7dda-40c2-85f4-ba09ecb9215c","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-18T14:19:06Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"49f60505-7dda-40c2-85f4-ba09ecb9215c","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-18T14:19:06Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8ccae607-22f7-4fcd-9267-41db5ba5548b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.15:57640","PortSpecifier":{"PortValue":57640}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.66:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"8ccae607-22f7-4fcd-9267-41db5ba5548b","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-66d5d1.apps.39547b11-1d3e-4f10-b633-e0544002afe5.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-18T14:19:06Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8ccae607-22f7-4fcd-9267-41db5ba5548b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.15:57640","PortSpecifier":{"PortValue":57640}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.66:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784384346,"nanos":963591832},"http":{"id":"8ccae607-22f7-4fcd-9267-41db5ba5548b","method":"POST","headers":{":authority":"e2e-shared-b-66d5d1.apps.39547b11-1d3e-4f10-b633-e0544002afe5.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-18T14:19:06Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"8ccae607-22f7-4fcd-9267-41db5ba5548b","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-18T14:19:06Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"8ccae607-22f7-4fcd-9267-41db5ba5548b","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"174c3db5-da7e-4544-8493-dd58af408773","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=87c706e3-6d49-45e0-bcb3-84d2482f826a"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/e0544002afe5"]}}
{"level":"debug","ts":"2026-07-18T14:19:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"8ccae607-22f7-4fcd-9267-41db5ba5548b","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/e0544002afe5"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=87c706e3-6d49-45e0-bcb3-84d2482f826a"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"174c3db5-da7e-4544-8493-dd58af408773","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"22e733782d005d6d450a45a4df0aede3b225b6a61d8ecad3f01cdce4c66611da"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.66:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-66d5d1.apps.39547b11-1d3e-4f10-b633-e0544002afe5.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-18T14:19:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8ccae607-22f7-4fcd-9267-41db5ba5548b","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-18T14:19:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8ccae607-22f7-4fcd-9267-41db5ba5548b","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-18T14:19:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8ccae607-22f7-4fcd-9267-41db5ba5548b","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-66d5d1/rate-test-model-66d5d1\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-66d5d1/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-18T14:19:06Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"8ccae607-22f7-4fcd-9267-41db5ba5548b","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-18T14:19:06Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8ccae607-22f7-4fcd-9267-41db5ba5548b","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-18T14:19:06Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8ccae607-22f7-4fcd-9267-41db5ba5548b","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-18T14:19:06Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8ccae607-22f7-4fcd-9267-41db5ba5548b","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-18T14:19:06Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8ccae607-22f7-4fcd-9267-41db5ba5548b","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-18T14:19:07Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"361b0d9c-7e34-4bda-9266-cbbf9e3c0dc7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.15:51344","PortSpecifier":{"PortValue":51344}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.53:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"361b0d9c-7e34-4bda-9266-cbbf9e3c0dc7","method":"POST","path":"/ai-tenant-e2e-shared-a-1bdd6b/rate-test-model-1bdd6b/v1/completions","host":"e2e-shared-a-1bdd6b.apps.39547b11-1d3e-4f10-b633-e0544002afe5.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-18T14:19:07Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"361b0d9c-7e34-4bda-9266-cbbf9e3c0dc7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.15:51344","PortSpecifier":{"PortValue":51344}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.53:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784384346,"nanos":999560704},"http":{"id":"361b0d9c-7e34-4bda-9266-cbbf9e3c0dc7","method":"POST","headers":{":authority":"e2e-shared-a-1bdd6b.apps.39547b11-1d3e-4f10-b633-e0544002afe5.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-1bdd6b/rate-test-model-1bdd6b/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-18T14:19:07Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"361b0d9c-7e34-4bda-9266-cbbf9e3c0dc7","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1HnaKW2BdtI2DXDZg_7hq7JP3Q9NUArf8bIxoRkyJW7QIxB0yZH7ZUCArN4AM"}
{"level":"debug","ts":"2026-07-18T14:19:07Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"361b0d9c-7e34-4bda-9266-cbbf9e3c0dc7","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-1bdd6b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1HnaKW2BdtI2DXDZg_7hq7JP3Q9NUArf8bIxoRkyJW7QIxB0yZH7ZUCArN4AM\"}"}
{"level":"debug","ts":"2026-07-18T14:19:07Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"361b0d9c-7e34-4bda-9266-cbbf9e3c0dc7","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1bdd6b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"175cf0a9-90cc-4dc8-bc3f-fcebc7472983","keyName":"e2e-rate-a-263605","subscription":"e2e-rate-iso-a-263605","tenant":"e2e-shared-a-1bdd6b","userId":"175cf0a9-90cc-4dc8-bc3f-fcebc7472983","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-18T14:19:07Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"361b0d9c-7e34-4bda-9266-cbbf9e3c0dc7","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-1bdd6b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-1bdd6b/rate-test-model-1bdd6b\",\"requestedSubscription\":\"e2e-rate-iso-a-263605\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-18T14:19:07Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"361b0d9c-7e34-4bda-9266-cbbf9e3c0dc7","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1bdd6b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-1bdd6b","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-263605","namespace":"ai-tenant-e2e-shared-a-1bdd6b","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-1bdd6b/rate-test-model-1bdd6b"}}
{"level":"debug","ts":"2026-07-18T14:19:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"361b0d9c-7e34-4bda-9266-cbbf9e3c0dc7","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-18T14:19:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"361b0d9c-7e34-4bda-9266-cbbf9e3c0dc7","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-18T14:19:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"361b0d9c-7e34-4bda-9266-cbbf9e3c0dc7","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-18T14:19:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"361b0d9c-7e34-4bda-9266-cbbf9e3c0dc7","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-1bdd6b/rate-test-model-1bdd6b\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-1bdd6b/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-18T14:19:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"361b0d9c-7e34-4bda-9266-cbbf9e3c0dc7","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-18T14:19:07Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"361b0d9c-7e34-4bda-9266-cbbf9e3c0dc7","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-18T14:19:07Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"361b0d9c-7e34-4bda-9266-cbbf9e3c0dc7","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-263605"}
{"level":"debug","ts":"2026-07-18T14:19:07Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"361b0d9c-7e34-4bda-9266-cbbf9e3c0dc7","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-18T14:19:07Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"361b0d9c-7e34-4bda-9266-cbbf9e3c0dc7","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"175cf0a9-90cc-4dc8-bc3f-fcebc7472983","keyName":"e2e-rate-a-263605","selected_subscription":"e2e-rate-iso-a-263605","selected_subscription_key":"ai-tenant-e2e-shared-a-1bdd6b/e2e-rate-iso-a-263605@ai-tenant-e2e-shared-a-1bdd6b/rate-test-model-1bdd6b","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-1bdd6b","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-263605","namespace":"ai-tenant-e2e-shared-a-1bdd6b","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-1bdd6b/rate-test-model-1bdd6b"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-18T14:19:07Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"361b0d9c-7e34-4bda-9266-cbbf9e3c0dc7","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-18T14:19:07Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"361b0d9c-7e34-4bda-9266-cbbf9e3c0dc7","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-18T14:19:08Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"60d5f90a-a39c-45ee-8b16-f3cdf4d1c75e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.15:51360","PortSpecifier":{"PortValue":51360}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.53:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"60d5f90a-a39c-45ee-8b16-f3cdf4d1c75e","method":"POST","path":"/ai-tenant-e2e-shared-a-1bdd6b/rate-test-model-1bdd6b/v1/completions","host":"e2e-shared-a-1bdd6b.apps.39547b11-1d3e-4f10-b633-e0544002afe5.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-18T14:19:08Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"60d5f90a-a39c-45ee-8b16-f3cdf4d1c75e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.15:51360","PortSpecifier":{"PortValue":51360}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.53:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784384348,"nanos":29517456},"http":{"id":"60d5f90a-a39c-45ee-8b16-f3cdf4d1c75e","method":"POST","headers":{":authority":"e2e-shared-a-1bdd6b.apps.39547b11-1d3e-4f10-b633-e0544002afe5.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-1bdd6b/rate-test-model-1bdd6b/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-18T14:19:08Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"60d5f90a-a39c-45ee-8b16-f3cdf4d1c75e","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1HnaKW2BdtI2DXDZg_7hq7JP3Q9NUArf8bIxoRkyJW7QIxB0yZH7ZUCArN4AM"}
{"level":"debug","ts":"2026-07-18T14:19:08Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"60d5f90a-a39c-45ee-8b16-f3cdf4d1c75e","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-1bdd6b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1HnaKW2BdtI2DXDZg_7hq7JP3Q9NUArf8bIxoRkyJW7QIxB0yZH7ZUCArN4AM\"}"}
{"level":"debug","ts":"2026-07-18T14:19:08Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"60d5f90a-a39c-45ee-8b16-f3cdf4d1c75e","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1bdd6b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"175cf0a9-90cc-4dc8-bc3f-fcebc7472983","keyName":"e2e-rate-a-263605","subscription":"e2e-rate-iso-a-263605","tenant":"e2e-shared-a-1bdd6b","userId":"175cf0a9-90cc-4dc8-bc3f-fcebc7472983","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-18T14:19:08Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"60d5f90a-a39c-45ee-8b16-f3cdf4d1c75e","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-1bdd6b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-1bdd6b/rate-test-model-1bdd6b\",\"requestedSubscription\":\"e2e-rate-iso-a-263605\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-18T14:19:08Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"60d5f90a-a39c-45ee-8b16-f3cdf4d1c75e","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1bdd6b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-1bdd6b","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-263605","namespace":"ai-tenant-e2e-shared-a-1bdd6b","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-1bdd6b/rate-test-model-1bdd6b"}}
{"level":"debug","ts":"2026-07-18T14:19:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"60d5f90a-a39c-45ee-8b16-f3cdf4d1c75e","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-18T14:19:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"60d5f90a-a39c-45ee-8b16-f3cdf4d1c75e","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-18T14:19:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"60d5f90a-a39c-45ee-8b16-f3cdf4d1c75e","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-18T14:19:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"60d5f90a-a39c-45ee-8b16-f3cdf4d1c75e","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-1bdd6b/rate-test-model-1bdd6b\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-1bdd6b/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-18T14:19:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"60d5f90a-a39c-45ee-8b16-f3cdf4d1c75e","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-18T14:19:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"60d5f90a-a39c-45ee-8b16-f3cdf4d1c75e","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-263605"}
{"level":"debug","ts":"2026-07-18T14:19:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"60d5f90a-a39c-45ee-8b16-f3cdf4d1c75e","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-18T14:19:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"60d5f90a-a39c-45ee-8b16-f3cdf4d1c75e","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-18T14:19:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"60d5f90a-a39c-45ee-8b16-f3cdf4d1c75e","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"175cf0a9-90cc-4dc8-bc3f-fcebc7472983","keyName":"e2e-rate-a-263605","selected_subscription":"e2e-rate-iso-a-263605","selected_subscription_key":"ai-tenant-e2e-shared-a-1bdd6b/e2e-rate-iso-a-263605@ai-tenant-e2e-shared-a-1bdd6b/rate-test-model-1bdd6b","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-1bdd6b","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-263605","namespace":"ai-tenant-e2e-shared-a-1bdd6b","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-1bdd6b/rate-test-model-1bdd6b"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-18T14:19:08Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"60d5f90a-a39c-45ee-8b16-f3cdf4d1c75e","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-18T14:19:08Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"60d5f90a-a39c-45ee-8b16-f3cdf4d1c75e","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-18T14:19:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"42a67ae3-afb6-4a67-9b6d-7ae94b71ec36","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.15:43392","PortSpecifier":{"PortValue":43392}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.53:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"42a67ae3-afb6-4a67-9b6d-7ae94b71ec36","method":"POST","path":"/ai-tenant-e2e-shared-a-1bdd6b/rate-test-model-1bdd6b/v1/completions","host":"e2e-shared-a-1bdd6b.apps.39547b11-1d3e-4f10-b633-e0544002afe5.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-18T14:19:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"42a67ae3-afb6-4a67-9b6d-7ae94b71ec36","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.15:43392","PortSpecifier":{"PortValue":43392}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.53:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784384349,"nanos":62597224},"http":{"id":"42a67ae3-afb6-4a67-9b6d-7ae94b71ec36","method":"POST","headers":{":authority":"e2e-shared-a-1bdd6b.apps.39547b11-1d3e-4f10-b633-e0544002afe5.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-1bdd6b/rate-test-model-1bdd6b/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-18T14:19:09Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"42a67ae3-afb6-4a67-9b6d-7ae94b71ec36","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1HnaKW2BdtI2DXDZg_7hq7JP3Q9NUArf8bIxoRkyJW7QIxB0yZH7ZUCArN4AM"}
{"level":"debug","ts":"2026-07-18T14:19:09Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"42a67ae3-afb6-4a67-9b6d-7ae94b71ec36","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-1bdd6b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1HnaKW2BdtI2DXDZg_7hq7JP3Q9NUArf8bIxoRkyJW7QIxB0yZH7ZUCArN4AM\"}"}
{"level":"debug","ts":"2026-07-18T14:19:09Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"42a67ae3-afb6-4a67-9b6d-7ae94b71ec36","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1bdd6b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"175cf0a9-90cc-4dc8-bc3f-fcebc7472983","keyName":"e2e-rate-a-263605","subscription":"e2e-rate-iso-a-263605","tenant":"e2e-shared-a-1bdd6b","userId":"175cf0a9-90cc-4dc8-bc3f-fcebc7472983","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-18T14:19:09Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"42a67ae3-afb6-4a67-9b6d-7ae94b71ec36","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-1bdd6b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-1bdd6b/rate-test-model-1bdd6b\",\"requestedSubscription\":\"e2e-rate-iso-a-263605\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-18T14:19:09Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"42a67ae3-afb6-4a67-9b6d-7ae94b71ec36","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1bdd6b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-1bdd6b","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-263605","namespace":"ai-tenant-e2e-shared-a-1bdd6b","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-1bdd6b/rate-test-model-1bdd6b"}}
{"level":"debug","ts":"2026-07-18T14:19:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"42a67ae3-afb6-4a67-9b6d-7ae94b71ec36","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-18T14:19:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"42a67ae3-afb6-4a67-9b6d-7ae94b71ec36","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-18T14:19:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"42a67ae3-afb6-4a67-9b6d-7ae94b71ec36","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-18T14:19:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"42a67ae3-afb6-4a67-9b6d-7ae94b71ec36","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-1bdd6b/rate-test-model-1bdd6b\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-1bdd6b/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-18T14:19:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"42a67ae3-afb6-4a67-9b6d-7ae94b71ec36","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-18T14:19:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"42a67ae3-afb6-4a67-9b6d-7ae94b71ec36","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-263605"}
{"level":"debug","ts":"2026-07-18T14:19:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"42a67ae3-afb6-4a67-9b6d-7ae94b71ec36","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-18T14:19:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"42a67ae3-afb6-4a67-9b6d-7ae94b71ec36","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-18T14:19:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"42a67ae3-afb6-4a67-9b6d-7ae94b71ec36","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"175cf0a9-90cc-4dc8-bc3f-fcebc7472983","keyName":"e2e-rate-a-263605","selected_subscription":"e2e-rate-iso-a-263605","selected_subscription_key":"ai-tenant-e2e-shared-a-1bdd6b/e2e-rate-iso-a-263605@ai-tenant-e2e-shared-a-1bdd6b/rate-test-model-1bdd6b","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-1bdd6b","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-263605","namespace":"ai-tenant-e2e-shared-a-1bdd6b","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-1bdd6b/rate-test-model-1bdd6b"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-18T14:19:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"42a67ae3-afb6-4a67-9b6d-7ae94b71ec36","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-18T14:19:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"42a67ae3-afb6-4a67-9b6d-7ae94b71ec36","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-18T14:19:10Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"cc7e04b9-8c9c-44f4-9df0-e2574af97bc7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.15:43396","PortSpecifier":{"PortValue":43396}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.53:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"cc7e04b9-8c9c-44f4-9df0-e2574af97bc7","method":"POST","path":"/ai-tenant-e2e-shared-a-1bdd6b/rate-test-model-1bdd6b/v1/completions","host":"e2e-shared-a-1bdd6b.apps.39547b11-1d3e-4f10-b633-e0544002afe5.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-18T14:19:10Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"cc7e04b9-8c9c-44f4-9df0-e2574af97bc7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.15:43396","PortSpecifier":{"PortValue":43396}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.53:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784384350,"nanos":97623454},"http":{"id":"cc7e04b9-8c9c-44f4-9df0-e2574af97bc7","method":"POST","headers":{":authority":"e2e-shared-a-1bdd6b.apps.39547b11-1d3e-4f10-b633-e0544002afe5.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-1bdd6b/rate-test-model-1bdd6b/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-18T14:19:10Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"cc7e04b9-8c9c-44f4-9df0-e2574af97bc7","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1HnaKW2BdtI2DXDZg_7hq7JP3Q9NUArf8bIxoRkyJW7QIxB0yZH7ZUCArN4AM"}
{"level":"debug","ts":"2026-07-18T14:19:10Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"cc7e04b9-8c9c-44f4-9df0-e2574af97bc7","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-1bdd6b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1HnaKW2BdtI2DXDZg_7hq7JP3Q9NUArf8bIxoRkyJW7QIxB0yZH7ZUCArN4AM\"}"}
{"level":"debug","ts":"2026-07-18T14:19:10Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"cc7e04b9-8c9c-44f4-9df0-e2574af97bc7","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1bdd6b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"175cf0a9-90cc-4dc8-bc3f-fcebc7472983","keyName":"e2e-rate-a-263605","subscription":"e2e-rate-iso-a-263605","tenant":"e2e-shared-a-1bdd6b","userId":"175cf0a9-90cc-4dc8-bc3f-fcebc7472983","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-18T14:19:10Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"cc7e04b9-8c9c-44f4-9df0-e2574af97bc7","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-1bdd6b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-1bdd6b/rate-test-model-1bdd6b\",\"requestedSubscription\":\"e2e-rate-iso-a-263605\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-18T14:19:10Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"cc7e04b9-8c9c-44f4-9df0-e2574af97bc7","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1bdd6b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-1bdd6b","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-263605","namespace":"ai-tenant-e2e-shared-a-1bdd6b","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-1bdd6b/rate-test-model-1bdd6b"}}
{"level":"debug","ts":"2026-07-18T14:19:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"cc7e04b9-8c9c-44f4-9df0-e2574af97bc7","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-18T14:19:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cc7e04b9-8c9c-44f4-9df0-e2574af97bc7","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-18T14:19:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cc7e04b9-8c9c-44f4-9df0-e2574af97bc7","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-18T14:19:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cc7e04b9-8c9c-44f4-9df0-e2574af97bc7","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-18T14:19:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cc7e04b9-8c9c-44f4-9df0-e2574af97bc7","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-1bdd6b/rate-test-model-1bdd6b\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-1bdd6b/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-18T14:19:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cc7e04b9-8c9c-44f4-9df0-e2574af97bc7","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-18T14:19:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cc7e04b9-8c9c-44f4-9df0-e2574af97bc7","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-263605"}
{"level":"debug","ts":"2026-07-18T14:19:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cc7e04b9-8c9c-44f4-9df0-e2574af97bc7","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-18T14:19:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cc7e04b9-8c9c-44f4-9df0-e2574af97bc7","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"175cf0a9-90cc-4dc8-bc3f-fcebc7472983","keyName":"e2e-rate-a-263605","selected_subscription":"e2e-rate-iso-a-263605","selected_subscription_key":"ai-tenant-e2e-shared-a-1bdd6b/e2e-rate-iso-a-263605@ai-tenant-e2e-shared-a-1bdd6b/rate-test-model-1bdd6b","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-1bdd6b","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-263605","namespace":"ai-tenant-e2e-shared-a-1bdd6b","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-1bdd6b/rate-test-model-1bdd6b"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-18T14:19:10Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"cc7e04b9-8c9c-44f4-9df0-e2574af97bc7","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-18T14:19:10Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"cc7e04b9-8c9c-44f4-9df0-e2574af97bc7","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-18T14:19:11Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7104360e-a66c-4a02-bc9e-18a54da49432","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.15:43406","PortSpecifier":{"PortValue":43406}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.53:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"7104360e-a66c-4a02-bc9e-18a54da49432","method":"POST","path":"/ai-tenant-e2e-shared-a-1bdd6b/rate-test-model-1bdd6b/v1/completions","host":"e2e-shared-a-1bdd6b.apps.39547b11-1d3e-4f10-b633-e0544002afe5.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-18T14:19:11Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7104360e-a66c-4a02-bc9e-18a54da49432","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.15:43406","PortSpecifier":{"PortValue":43406}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.53:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784384351,"nanos":142849098},"http":{"id":"7104360e-a66c-4a02-bc9e-18a54da49432","method":"POST","headers":{":authority":"e2e-shared-a-1bdd6b.apps.39547b11-1d3e-4f10-b633-e0544002afe5.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-1bdd6b/rate-test-model-1bdd6b/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-18T14:19:11Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"7104360e-a66c-4a02-bc9e-18a54da49432","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1HnaKW2BdtI2DXDZg_7hq7JP3Q9NUArf8bIxoRkyJW7QIxB0yZH7ZUCArN4AM"}
{"level":"debug","ts":"2026-07-18T14:19:11Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"7104360e-a66c-4a02-bc9e-18a54da49432","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-1bdd6b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1HnaKW2BdtI2DXDZg_7hq7JP3Q9NUArf8bIxoRkyJW7QIxB0yZH7ZUCArN4AM\"}"}
{"level":"debug","ts":"2026-07-18T14:19:11Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"7104360e-a66c-4a02-bc9e-18a54da49432","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1bdd6b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"175cf0a9-90cc-4dc8-bc3f-fcebc7472983","keyName":"e2e-rate-a-263605","subscription":"e2e-rate-iso-a-263605","tenant":"e2e-shared-a-1bdd6b","userId":"175cf0a9-90cc-4dc8-bc3f-fcebc7472983","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-18T14:19:11Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"7104360e-a66c-4a02-bc9e-18a54da49432","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-1bdd6b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-1bdd6b/rate-test-model-1bdd6b\",\"requestedSubscription\":\"e2e-rate-iso-a-263605\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-18T14:19:11Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"7104360e-a66c-4a02-bc9e-18a54da49432","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1bdd6b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-1bdd6b","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-263605","namespace":"ai-tenant-e2e-shared-a-1bdd6b","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-1bdd6b/rate-test-model-1bdd6b"}}
{"level":"debug","ts":"2026-07-18T14:19:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"7104360e-a66c-4a02-bc9e-18a54da49432","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-18T14:19:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7104360e-a66c-4a02-bc9e-18a54da49432","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-18T14:19:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7104360e-a66c-4a02-bc9e-18a54da49432","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-18T14:19:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7104360e-a66c-4a02-bc9e-18a54da49432","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-1bdd6b/rate-test-model-1bdd6b\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-1bdd6b/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-18T14:19:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7104360e-a66c-4a02-bc9e-18a54da49432","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-18T14:19:11Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7104360e-a66c-4a02-bc9e-18a54da49432","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-18T14:19:11Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7104360e-a66c-4a02-bc9e-18a54da49432","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-263605"}
{"level":"debug","ts":"2026-07-18T14:19:11Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7104360e-a66c-4a02-bc9e-18a54da49432","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-18T14:19:11Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7104360e-a66c-4a02-bc9e-18a54da49432","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"175cf0a9-90cc-4dc8-bc3f-fcebc7472983","keyName":"e2e-rate-a-263605","selected_subscription":"e2e-rate-iso-a-263605","selected_subscription_key":"ai-tenant-e2e-shared-a-1bdd6b/e2e-rate-iso-a-263605@ai-tenant-e2e-shared-a-1bdd6b/rate-test-model-1bdd6b","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-1bdd6b","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-263605","namespace":"ai-tenant-e2e-shared-a-1bdd6b","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-1bdd6b/rate-test-model-1bdd6b"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-18T14:19:11Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7104360e-a66c-4a02-bc9e-18a54da49432","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-18T14:19:11Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7104360e-a66c-4a02-bc9e-18a54da49432","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-18T14:19:12Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"65501313-a991-49fd-b434-5f6f53c84450","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.15:43418","PortSpecifier":{"PortValue":43418}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.53:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"65501313-a991-49fd-b434-5f6f53c84450","method":"POST","path":"/ai-tenant-e2e-shared-a-1bdd6b/rate-test-model-1bdd6b/v1/completions","host":"e2e-shared-a-1bdd6b.apps.39547b11-1d3e-4f10-b633-e0544002afe5.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-18T14:19:12Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"65501313-a991-49fd-b434-5f6f53c84450","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.15:43418","PortSpecifier":{"PortValue":43418}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.53:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784384352,"nanos":175104100},"http":{"id":"65501313-a991-49fd-b434-5f6f53c84450","method":"POST","headers":{":authority":"e2e-shared-a-1bdd6b.apps.39547b11-1d3e-4f10-b633-e0544002afe5.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-1bdd6b/rate-test-model-1bdd6b/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-18T14:19:12Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"65501313-a991-49fd-b434-5f6f53c84450","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1HnaKW2BdtI2DXDZg_7hq7JP3Q9NUArf8bIxoRkyJW7QIxB0yZH7ZUCArN4AM"}
{"level":"debug","ts":"2026-07-18T14:19:12Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"65501313-a991-49fd-b434-5f6f53c84450","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-1bdd6b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1HnaKW2BdtI2DXDZg_7hq7JP3Q9NUArf8bIxoRkyJW7QIxB0yZH7ZUCArN4AM\"}"}
{"level":"debug","ts":"2026-07-18T14:19:12Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"65501313-a991-49fd-b434-5f6f53c84450","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1bdd6b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"175cf0a9-90cc-4dc8-bc3f-fcebc7472983","keyName":"e2e-rate-a-263605","subscription":"e2e-rate-iso-a-263605","tenant":"e2e-shared-a-1bdd6b","userId":"175cf0a9-90cc-4dc8-bc3f-fcebc7472983","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-18T14:19:12Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"65501313-a991-49fd-b434-5f6f53c84450","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-1bdd6b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-1bdd6b/rate-test-model-1bdd6b\",\"requestedSubscription\":\"e2e-rate-iso-a-263605\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-18T14:19:12Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"65501313-a991-49fd-b434-5f6f53c84450","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1bdd6b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-1bdd6b","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-263605","namespace":"ai-tenant-e2e-shared-a-1bdd6b","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-1bdd6b/rate-test-model-1bdd6b"}}
{"level":"debug","ts":"2026-07-18T14:19:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"65501313-a991-49fd-b434-5f6f53c84450","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-18T14:19:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"65501313-a991-49fd-b434-5f6f53c84450","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-18T14:19:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"65501313-a991-49fd-b434-5f6f53c84450","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-18T14:19:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"65501313-a991-49fd-b434-5f6f53c84450","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-18T14:19:12Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"65501313-a991-49fd-b434-5f6f53c84450","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-1bdd6b/rate-test-model-1bdd6b\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-1bdd6b/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-18T14:19:12Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"65501313-a991-49fd-b434-5f6f53c84450","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-18T14:19:12Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"65501313-a991-49fd-b434-5f6f53c84450","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-263605"}
{"level":"debug","ts":"2026-07-18T14:19:12Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"65501313-a991-49fd-b434-5f6f53c84450","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-18T14:19:12Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"65501313-a991-49fd-b434-5f6f53c84450","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"175cf0a9-90cc-4dc8-bc3f-fcebc7472983","keyName":"e2e-rate-a-263605","selected_subscription":"e2e-rate-iso-a-263605","selected_subscription_key":"ai-tenant-e2e-shared-a-1bdd6b/e2e-rate-iso-a-263605@ai-tenant-e2e-shared-a-1bdd6b/rate-test-model-1bdd6b","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-1bdd6b","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-263605","namespace":"ai-tenant-e2e-shared-a-1bdd6b","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-1bdd6b/rate-test-model-1bdd6b"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-18T14:19:12Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"65501313-a991-49fd-b434-5f6f53c84450","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-18T14:19:12Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"65501313-a991-49fd-b434-5f6f53c84450","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-18T14:19:13Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"74830ab2-ed14-4177-9f91-edbfb07bcf53","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.15:43428","PortSpecifier":{"PortValue":43428}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.53:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"74830ab2-ed14-4177-9f91-edbfb07bcf53","method":"POST","path":"/ai-tenant-e2e-shared-a-1bdd6b/rate-test-model-1bdd6b/v1/completions","host":"e2e-shared-a-1bdd6b.apps.39547b11-1d3e-4f10-b633-e0544002afe5.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-18T14:19:13Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"74830ab2-ed14-4177-9f91-edbfb07bcf53","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.15:43428","PortSpecifier":{"PortValue":43428}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.53:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784384353,"nanos":208059794},"http":{"id":"74830ab2-ed14-4177-9f91-edbfb07bcf53","method":"POST","headers":{":authority":"e2e-shared-a-1bdd6b.apps.39547b11-1d3e-4f10-b633-e0544002afe5.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-1bdd6b/rate-test-model-1bdd6b/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-18T14:19:13Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"74830ab2-ed14-4177-9f91-edbfb07bcf53","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1HnaKW2BdtI2DXDZg_7hq7JP3Q9NUArf8bIxoRkyJW7QIxB0yZH7ZUCArN4AM"}
{"level":"debug","ts":"2026-07-18T14:19:13Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"74830ab2-ed14-4177-9f91-edbfb07bcf53","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-1bdd6b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1HnaKW2BdtI2DXDZg_7hq7JP3Q9NUArf8bIxoRkyJW7QIxB0yZH7ZUCArN4AM\"}"}
{"level":"debug","ts":"2026-07-18T14:19:13Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"74830ab2-ed14-4177-9f91-edbfb07bcf53","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1bdd6b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"175cf0a9-90cc-4dc8-bc3f-fcebc7472983","keyName":"e2e-rate-a-263605","subscription":"e2e-rate-iso-a-263605","tenant":"e2e-shared-a-1bdd6b","userId":"175cf0a9-90cc-4dc8-bc3f-fcebc7472983","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-18T14:19:13Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"74830ab2-ed14-4177-9f91-edbfb07bcf53","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-1bdd6b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-1bdd6b/rate-test-model-1bdd6b\",\"requestedSubscription\":\"e2e-rate-iso-a-263605\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-18T14:19:13Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"74830ab2-ed14-4177-9f91-edbfb07bcf53","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1bdd6b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-1bdd6b","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-263605","namespace":"ai-tenant-e2e-shared-a-1bdd6b","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-1bdd6b/rate-test-model-1bdd6b"}}
{"level":"debug","ts":"2026-07-18T14:19:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"74830ab2-ed14-4177-9f91-edbfb07bcf53","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-18T14:19:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"74830ab2-ed14-4177-9f91-edbfb07bcf53","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-18T14:19:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"74830ab2-ed14-4177-9f91-edbfb07bcf53","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-18T14:19:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"74830ab2-ed14-4177-9f91-edbfb07bcf53","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-18T14:19:13Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"74830ab2-ed14-4177-9f91-edbfb07bcf53","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-1bdd6b/rate-test-model-1bdd6b\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-1bdd6b/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-18T14:19:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"74830ab2-ed14-4177-9f91-edbfb07bcf53","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-18T14:19:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"74830ab2-ed14-4177-9f91-edbfb07bcf53","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-18T14:19:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"74830ab2-ed14-4177-9f91-edbfb07bcf53","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-263605"}
{"level":"debug","ts":"2026-07-18T14:19:13Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"74830ab2-ed14-4177-9f91-edbfb07bcf53","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"175cf0a9-90cc-4dc8-bc3f-fcebc7472983","keyName":"e2e-rate-a-263605","selected_subscription":"e2e-rate-iso-a-263605","selected_subscription_key":"ai-tenant-e2e-shared-a-1bdd6b/e2e-rate-iso-a-263605@ai-tenant-e2e-shared-a-1bdd6b/rate-test-model-1bdd6b","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-1bdd6b","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-263605","namespace":"ai-tenant-e2e-shared-a-1bdd6b","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-1bdd6b/rate-test-model-1bdd6b"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-18T14:19:13Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"74830ab2-ed14-4177-9f91-edbfb07bcf53","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-18T14:19:13Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"74830ab2-ed14-4177-9f91-edbfb07bcf53","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-18T14:19:14Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"225e9ad1-3300-4d54-88fa-86330dfa86c3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.15:43444","PortSpecifier":{"PortValue":43444}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.53:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"225e9ad1-3300-4d54-88fa-86330dfa86c3","method":"POST","path":"/ai-tenant-e2e-shared-a-1bdd6b/rate-test-model-1bdd6b/v1/completions","host":"e2e-shared-a-1bdd6b.apps.39547b11-1d3e-4f10-b633-e0544002afe5.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-18T14:19:14Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"225e9ad1-3300-4d54-88fa-86330dfa86c3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.15:43444","PortSpecifier":{"PortValue":43444}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.53:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784384354,"nanos":239383396},"http":{"id":"225e9ad1-3300-4d54-88fa-86330dfa86c3","method":"POST","headers":{":authority":"e2e-shared-a-1bdd6b.apps.39547b11-1d3e-4f10-b633-e0544002afe5.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-1bdd6b/rate-test-model-1bdd6b/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-18T14:19:14Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"225e9ad1-3300-4d54-88fa-86330dfa86c3","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1HnaKW2BdtI2DXDZg_7hq7JP3Q9NUArf8bIxoRkyJW7QIxB0yZH7ZUCArN4AM"}
{"level":"debug","ts":"2026-07-18T14:19:14Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"225e9ad1-3300-4d54-88fa-86330dfa86c3","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-1bdd6b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1HnaKW2BdtI2DXDZg_7hq7JP3Q9NUArf8bIxoRkyJW7QIxB0yZH7ZUCArN4AM\"}"}
{"level":"debug","ts":"2026-07-18T14:19:14Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"225e9ad1-3300-4d54-88fa-86330dfa86c3","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1bdd6b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"175cf0a9-90cc-4dc8-bc3f-fcebc7472983","keyName":"e2e-rate-a-263605","subscription":"e2e-rate-iso-a-263605","tenant":"e2e-shared-a-1bdd6b","userId":"175cf0a9-90cc-4dc8-bc3f-fcebc7472983","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-18T14:19:14Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"225e9ad1-3300-4d54-88fa-86330dfa86c3","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-1bdd6b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-1bdd6b/rate-test-model-1bdd6b\",\"requestedSubscription\":\"e2e-rate-iso-a-263605\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-18T14:19:14Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"225e9ad1-3300-4d54-88fa-86330dfa86c3","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1bdd6b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-1bdd6b","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-263605","namespace":"ai-tenant-e2e-shared-a-1bdd6b","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-1bdd6b/rate-test-model-1bdd6b"}}
{"level":"debug","ts":"2026-07-18T14:19:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"225e9ad1-3300-4d54-88fa-86330dfa86c3","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-18T14:19:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"225e9ad1-3300-4d54-88fa-86330dfa86c3","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-18T14:19:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"225e9ad1-3300-4d54-88fa-86330dfa86c3","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-18T14:19:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"225e9ad1-3300-4d54-88fa-86330dfa86c3","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-1bdd6b/rate-test-model-1bdd6b\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-1bdd6b/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-18T14:19:14Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"225e9ad1-3300-4d54-88fa-86330dfa86c3","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-18T14:19:14Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"225e9ad1-3300-4d54-88fa-86330dfa86c3","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-18T14:19:14Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"225e9ad1-3300-4d54-88fa-86330dfa86c3","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-18T14:19:14Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"225e9ad1-3300-4d54-88fa-86330dfa86c3","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-263605"}
{"level":"debug","ts":"2026-07-18T14:19:14Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"225e9ad1-3300-4d54-88fa-86330dfa86c3","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"175cf0a9-90cc-4dc8-bc3f-fcebc7472983","keyName":"e2e-rate-a-263605","selected_subscription":"e2e-rate-iso-a-263605","selected_subscription_key":"ai-tenant-e2e-shared-a-1bdd6b/e2e-rate-iso-a-263605@ai-tenant-e2e-shared-a-1bdd6b/rate-test-model-1bdd6b","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-1bdd6b","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-263605","namespace":"ai-tenant-e2e-shared-a-1bdd6b","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-1bdd6b/rate-test-model-1bdd6b"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-18T14:19:14Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"225e9ad1-3300-4d54-88fa-86330dfa86c3","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-18T14:19:14Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"225e9ad1-3300-4d54-88fa-86330dfa86c3","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-18T14:19:15Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3b741279-10c7-4c65-a265-4d30e2c014c6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.15:43450","PortSpecifier":{"PortValue":43450}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.53:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"3b741279-10c7-4c65-a265-4d30e2c014c6","method":"POST","path":"/ai-tenant-e2e-shared-a-1bdd6b/rate-test-model-1bdd6b/v1/completions","host":"e2e-shared-a-1bdd6b.apps.39547b11-1d3e-4f10-b633-e0544002afe5.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-18T14:19:15Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3b741279-10c7-4c65-a265-4d30e2c014c6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.15:43450","PortSpecifier":{"PortValue":43450}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.53:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784384355,"nanos":276071787},"http":{"id":"3b741279-10c7-4c65-a265-4d30e2c014c6","method":"POST","headers":{":authority":"e2e-shared-a-1bdd6b.apps.39547b11-1d3e-4f10-b633-e0544002afe5.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-1bdd6b/rate-test-model-1bdd6b/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-18T14:19:15Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"3b741279-10c7-4c65-a265-4d30e2c014c6","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1HnaKW2BdtI2DXDZg_7hq7JP3Q9NUArf8bIxoRkyJW7QIxB0yZH7ZUCArN4AM"}
{"level":"debug","ts":"2026-07-18T14:19:15Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"3b741279-10c7-4c65-a265-4d30e2c014c6","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-1bdd6b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1HnaKW2BdtI2DXDZg_7hq7JP3Q9NUArf8bIxoRkyJW7QIxB0yZH7ZUCArN4AM\"}"}
{"level":"debug","ts":"2026-07-18T14:19:15Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"3b741279-10c7-4c65-a265-4d30e2c014c6","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1bdd6b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"175cf0a9-90cc-4dc8-bc3f-fcebc7472983","keyName":"e2e-rate-a-263605","subscription":"e2e-rate-iso-a-263605","tenant":"e2e-shared-a-1bdd6b","userId":"175cf0a9-90cc-4dc8-bc3f-fcebc7472983","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-18T14:19:15Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"3b741279-10c7-4c65-a265-4d30e2c014c6","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-1bdd6b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-1bdd6b/rate-test-model-1bdd6b\",\"requestedSubscription\":\"e2e-rate-iso-a-263605\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-18T14:19:15Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"3b741279-10c7-4c65-a265-4d30e2c014c6","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1bdd6b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-1bdd6b","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-263605","namespace":"ai-tenant-e2e-shared-a-1bdd6b","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-1bdd6b/rate-test-model-1bdd6b"}}
{"level":"debug","ts":"2026-07-18T14:19:15Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"3b741279-10c7-4c65-a265-4d30e2c014c6","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-18T14:19:15Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3b741279-10c7-4c65-a265-4d30e2c014c6","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-18T14:19:15Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3b741279-10c7-4c65-a265-4d30e2c014c6","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-18T14:19:15Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3b741279-10c7-4c65-a265-4d30e2c014c6","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-18T14:19:15Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3b741279-10c7-4c65-a265-4d30e2c014c6","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-1bdd6b/rate-test-model-1bdd6b\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-1bdd6b/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-18T14:19:15Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3b741279-10c7-4c65-a265-4d30e2c014c6","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-18T14:19:15Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3b741279-10c7-4c65-a265-4d30e2c014c6","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-18T14:19:15Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3b741279-10c7-4c65-a265-4d30e2c014c6","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-263605"}
{"level":"debug","ts":"2026-07-18T14:19:15Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3b741279-10c7-4c65-a265-4d30e2c014c6","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"175cf0a9-90cc-4dc8-bc3f-fcebc7472983","keyName":"e2e-rate-a-263605","selected_subscription":"e2e-rate-iso-a-263605","selected_subscription_key":"ai-tenant-e2e-shared-a-1bdd6b/e2e-rate-iso-a-263605@ai-tenant-e2e-shared-a-1bdd6b/rate-test-model-1bdd6b","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-1bdd6b","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-263605","namespace":"ai-tenant-e2e-shared-a-1bdd6b","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-1bdd6b/rate-test-model-1bdd6b"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-18T14:19:15Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3b741279-10c7-4c65-a265-4d30e2c014c6","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-18T14:19:15Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3b741279-10c7-4c65-a265-4d30e2c014c6","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-18T14:19:16Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3f7a8656-868c-483f-8417-e5cf8b84b950","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.15:43452","PortSpecifier":{"PortValue":43452}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.53:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"3f7a8656-868c-483f-8417-e5cf8b84b950","method":"POST","path":"/ai-tenant-e2e-shared-a-1bdd6b/rate-test-model-1bdd6b/v1/completions","host":"e2e-shared-a-1bdd6b.apps.39547b11-1d3e-4f10-b633-e0544002afe5.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-18T14:19:16Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3f7a8656-868c-483f-8417-e5cf8b84b950","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.15:43452","PortSpecifier":{"PortValue":43452}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.53:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784384356,"nanos":307535665},"http":{"id":"3f7a8656-868c-483f-8417-e5cf8b84b950","method":"POST","headers":{":authority":"e2e-shared-a-1bdd6b.apps.39547b11-1d3e-4f10-b633-e0544002afe5.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-1bdd6b/rate-test-model-1bdd6b/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-18T14:19:16Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"3f7a8656-868c-483f-8417-e5cf8b84b950","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1HnaKW2BdtI2DXDZg_7hq7JP3Q9NUArf8bIxoRkyJW7QIxB0yZH7ZUCArN4AM"}
{"level":"debug","ts":"2026-07-18T14:19:16Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"3f7a8656-868c-483f-8417-e5cf8b84b950","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-1bdd6b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1HnaKW2BdtI2DXDZg_7hq7JP3Q9NUArf8bIxoRkyJW7QIxB0yZH7ZUCArN4AM\"}"}
{"level":"debug","ts":"2026-07-18T14:19:16Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"3f7a8656-868c-483f-8417-e5cf8b84b950","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1bdd6b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"175cf0a9-90cc-4dc8-bc3f-fcebc7472983","keyName":"e2e-rate-a-263605","subscription":"e2e-rate-iso-a-263605","tenant":"e2e-shared-a-1bdd6b","userId":"175cf0a9-90cc-4dc8-bc3f-fcebc7472983","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-18T14:19:16Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"3f7a8656-868c-483f-8417-e5cf8b84b950","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-1bdd6b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-1bdd6b/rate-test-model-1bdd6b\",\"requestedSubscription\":\"e2e-rate-iso-a-263605\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-18T14:19:16Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"3f7a8656-868c-483f-8417-e5cf8b84b950","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1bdd6b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-1bdd6b","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-263605","namespace":"ai-tenant-e2e-shared-a-1bdd6b","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-1bdd6b/rate-test-model-1bdd6b"}}
{"level":"debug","ts":"2026-07-18T14:19:16Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"3f7a8656-868c-483f-8417-e5cf8b84b950","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-18T14:19:16Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3f7a8656-868c-483f-8417-e5cf8b84b950","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-18T14:19:16Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3f7a8656-868c-483f-8417-e5cf8b84b950","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-18T14:19:16Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3f7a8656-868c-483f-8417-e5cf8b84b950","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-1bdd6b/rate-test-model-1bdd6b\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-1bdd6b/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-18T14:19:16Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3f7a8656-868c-483f-8417-e5cf8b84b950","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-18T14:19:16Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3f7a8656-868c-483f-8417-e5cf8b84b950","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-18T14:19:16Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3f7a8656-868c-483f-8417-e5cf8b84b950","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-263605"}
{"level":"debug","ts":"2026-07-18T14:19:16Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3f7a8656-868c-483f-8417-e5cf8b84b950","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-18T14:19:16Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3f7a8656-868c-483f-8417-e5cf8b84b950","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"175cf0a9-90cc-4dc8-bc3f-fcebc7472983","keyName":"e2e-rate-a-263605","selected_subscription":"e2e-rate-iso-a-263605","selected_subscription_key":"ai-tenant-e2e-shared-a-1bdd6b/e2e-rate-iso-a-263605@ai-tenant-e2e-shared-a-1bdd6b/rate-test-model-1bdd6b","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-1bdd6b","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-263605","namespace":"ai-tenant-e2e-shared-a-1bdd6b","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-1bdd6b/rate-test-model-1bdd6b"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-18T14:19:16Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3f7a8656-868c-483f-8417-e5cf8b84b950","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-18T14:19:16Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3f7a8656-868c-483f-8417-e5cf8b84b950","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-18T14:19:17Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"bb53e4f8-d94f-4af9-b5c0-e31709207341","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.15:43462","PortSpecifier":{"PortValue":43462}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.53:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"bb53e4f8-d94f-4af9-b5c0-e31709207341","method":"POST","path":"/ai-tenant-e2e-shared-a-1bdd6b/rate-test-model-1bdd6b/v1/completions","host":"e2e-shared-a-1bdd6b.apps.39547b11-1d3e-4f10-b633-e0544002afe5.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-18T14:19:17Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"bb53e4f8-d94f-4af9-b5c0-e31709207341","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.15:43462","PortSpecifier":{"PortValue":43462}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.53:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784384357,"nanos":338676213},"http":{"id":"bb53e4f8-d94f-4af9-b5c0-e31709207341","method":"POST","headers":{":authority":"e2e-shared-a-1bdd6b.apps.39547b11-1d3e-4f10-b633-e0544002afe5.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-1bdd6b/rate-test-model-1bdd6b/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-18T14:19:17Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"bb53e4f8-d94f-4af9-b5c0-e31709207341","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1HnaKW2BdtI2DXDZg_7hq7JP3Q9NUArf8bIxoRkyJW7QIxB0yZH7ZUCArN4AM"}
{"level":"debug","ts":"2026-07-18T14:19:17Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"bb53e4f8-d94f-4af9-b5c0-e31709207341","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-1bdd6b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1HnaKW2BdtI2DXDZg_7hq7JP3Q9NUArf8bIxoRkyJW7QIxB0yZH7ZUCArN4AM\"}"}
{"level":"debug","ts":"2026-07-18T14:19:17Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"bb53e4f8-d94f-4af9-b5c0-e31709207341","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1bdd6b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"175cf0a9-90cc-4dc8-bc3f-fcebc7472983","keyName":"e2e-rate-a-263605","subscription":"e2e-rate-iso-a-263605","tenant":"e2e-shared-a-1bdd6b","userId":"175cf0a9-90cc-4dc8-bc3f-fcebc7472983","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-18T14:19:17Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"bb53e4f8-d94f-4af9-b5c0-e31709207341","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-1bdd6b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-1bdd6b/rate-test-model-1bdd6b\",\"requestedSubscription\":\"e2e-rate-iso-a-263605\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-18T14:19:17Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"bb53e4f8-d94f-4af9-b5c0-e31709207341","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1bdd6b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-1bdd6b","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-263605","namespace":"ai-tenant-e2e-shared-a-1bdd6b","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-1bdd6b/rate-test-model-1bdd6b"}}
{"level":"debug","ts":"2026-07-18T14:19:17Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"bb53e4f8-d94f-4af9-b5c0-e31709207341","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-18T14:19:17Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"bb53e4f8-d94f-4af9-b5c0-e31709207341","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-18T14:19:17Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"bb53e4f8-d94f-4af9-b5c0-e31709207341","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-18T14:19:17Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"bb53e4f8-d94f-4af9-b5c0-e31709207341","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-18T14:19:17Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"bb53e4f8-d94f-4af9-b5c0-e31709207341","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-1bdd6b/rate-test-model-1bdd6b\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-1bdd6b/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-18T14:19:17Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"bb53e4f8-d94f-4af9-b5c0-e31709207341","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-18T14:19:17Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"bb53e4f8-d94f-4af9-b5c0-e31709207341","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-263605"}
{"level":"debug","ts":"2026-07-18T14:19:17Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"bb53e4f8-d94f-4af9-b5c0-e31709207341","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-18T14:19:17Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"bb53e4f8-d94f-4af9-b5c0-e31709207341","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"175cf0a9-90cc-4dc8-bc3f-fcebc7472983","keyName":"e2e-rate-a-263605","selected_subscription":"e2e-rate-iso-a-263605","selected_subscription_key":"ai-tenant-e2e-shared-a-1bdd6b/e2e-rate-iso-a-263605@ai-tenant-e2e-shared-a-1bdd6b/rate-test-model-1bdd6b","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-1bdd6b","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-263605","namespace":"ai-tenant-e2e-shared-a-1bdd6b","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-1bdd6b/rate-test-model-1bdd6b"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-18T14:19:17Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"bb53e4f8-d94f-4af9-b5c0-e31709207341","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-18T14:19:17Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"bb53e4f8-d94f-4af9-b5c0-e31709207341","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-18T14:19:17Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1565b28d-aa6b-46ef-b5e5-dc848d4e6516","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.15:46478","PortSpecifier":{"PortValue":46478}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.66:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"1565b28d-aa6b-46ef-b5e5-dc848d4e6516","method":"POST","path":"/ai-tenant-e2e-shared-b-66d5d1/rate-test-model-66d5d1/v1/completions","host":"e2e-shared-b-66d5d1.apps.39547b11-1d3e-4f10-b633-e0544002afe5.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-18T14:19:17Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1565b28d-aa6b-46ef-b5e5-dc848d4e6516","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.15:46478","PortSpecifier":{"PortValue":46478}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.66:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784384357,"nanos":372001780},"http":{"id":"1565b28d-aa6b-46ef-b5e5-dc848d4e6516","method":"POST","headers":{":authority":"e2e-shared-b-66d5d1.apps.39547b11-1d3e-4f10-b633-e0544002afe5.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-b-66d5d1/rate-test-model-66d5d1/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-18T14:19:17Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"1565b28d-aa6b-46ef-b5e5-dc848d4e6516","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-6rAYcV86NhJdmwxu_aF1ruUtgzbRbto9tK5KOqmK8S3gKf1SBz6aRpD4SJTc"}
{"level":"debug","ts":"2026-07-18T14:19:17Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"1565b28d-aa6b-46ef-b5e5-dc848d4e6516","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-b-66d5d1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-6rAYcV86NhJdmwxu_aF1ruUtgzbRbto9tK5KOqmK8S3gKf1SBz6aRpD4SJTc\"}"}
{"level":"debug","ts":"2026-07-18T14:19:17Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"1565b28d-aa6b-46ef-b5e5-dc848d4e6516","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-66d5d1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"bf904077-c377-4998-946d-234f41940e44","keyName":"e2e-rate-b-263605","subscription":"e2e-rate-iso-b-263605","tenant":"e2e-shared-b-66d5d1","userId":"bf904077-c377-4998-946d-234f41940e44","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-18T14:19:17Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"1565b28d-aa6b-46ef-b5e5-dc848d4e6516","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-b-66d5d1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-b-66d5d1/rate-test-model-66d5d1\",\"requestedSubscription\":\"e2e-rate-iso-b-263605\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-18T14:19:17Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"1565b28d-aa6b-46ef-b5e5-dc848d4e6516","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-66d5d1.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-66d5d1","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-263605","namespace":"ai-tenant-e2e-shared-b-66d5d1","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-b-66d5d1/rate-test-model-66d5d1"}}
{"level":"debug","ts":"2026-07-18T14:19:17Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"1565b28d-aa6b-46ef-b5e5-dc848d4e6516","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-18T14:19:17Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1565b28d-aa6b-46ef-b5e5-dc848d4e6516","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-18T14:19:17Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1565b28d-aa6b-46ef-b5e5-dc848d4e6516","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-18T14:19:17Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1565b28d-aa6b-46ef-b5e5-dc848d4e6516","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-18T14:19:17Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1565b28d-aa6b-46ef-b5e5-dc848d4e6516","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-66d5d1/rate-test-model-66d5d1\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-66d5d1/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-18T14:19:17Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1565b28d-aa6b-46ef-b5e5-dc848d4e6516","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-18T14:19:17Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1565b28d-aa6b-46ef-b5e5-dc848d4e6516","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-18T14:19:17Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1565b28d-aa6b-46ef-b5e5-dc848d4e6516","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-b-263605"}
{"level":"debug","ts":"2026-07-18T14:19:17Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1565b28d-aa6b-46ef-b5e5-dc848d4e6516","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"bf904077-c377-4998-946d-234f41940e44","keyName":"e2e-rate-b-263605","selected_subscription":"e2e-rate-iso-b-263605","selected_subscription_key":"ai-tenant-e2e-shared-b-66d5d1/e2e-rate-iso-b-263605@ai-tenant-e2e-shared-b-66d5d1/rate-test-model-66d5d1","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-66d5d1","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-263605","namespace":"ai-tenant-e2e-shared-b-66d5d1","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-b-66d5d1/rate-test-model-66d5d1"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-18T14:19:17Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1565b28d-aa6b-46ef-b5e5-dc848d4e6516","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-18T14:19:17Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1565b28d-aa6b-46ef-b5e5-dc848d4e6516","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-18T14:19:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/a28f3c625572777a55dc35b5fbfdabe7caf80c83560491078fb7d22af286c7f6"}
{"level":"info","ts":"2026-07-18T14:19:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/8d2e50d08bcca580be072c53f24302921342a3a2a1fd4e0e0c2a8ed1371d5c7b"}
{"level":"info","ts":"2026-07-18T14:19:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/b72024bef510b195a99b27e547f63ee790ca630d8e300f860f27ed4250266ad3"}
{"level":"info","ts":"2026-07-18T14:19:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/d43c7910f82cc00875764db3b37d582a6a576ef0ffd19c32da26281bdf98dcb2"}
{"level":"info","ts":"2026-07-18T14:19:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/3e9a95d078a2e18d00feed8936feee975d4343af6768f5a2f4bcd4536c5816e5"}
{"level":"info","ts":"2026-07-18T14:19:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/a54f9df8dcf4b060c56266a8069c0c4a43f94646f5ec3eefb312c0da3d62be75"}
{"level":"info","ts":"2026-07-18T14:19:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/001dbd4f1a0ad016669369f81ad90ece57c22f6092d69475ad9c720841278ba7"}
{"level":"info","ts":"2026-07-18T14:19:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/125b7dbcfadb7c4700074158e6d89822ca4b7053ef2066771e67556235b88fd1"}
{"level":"info","ts":"2026-07-18T14:19:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/c5e6840f7f8a2aeaefbcbd75059190c6e9595045e42d4804ade150978a143d02"}
{"level":"info","ts":"2026-07-18T14:19:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/6222ae8aeb4fe1702808149bc6eef36dfbb57982fe7a13b30a8987cd0442664a"}
{"level":"info","ts":"2026-07-18T14:19:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/c0b0f173e6f98385f80f0d26d0106b0e0be5371e75876af54d1b45200d8ef4fe"}
{"level":"info","ts":"2026-07-18T14:19:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/22e733782d005d6d450a45a4df0aede3b225b6a61d8ecad3f01cdce4c66611da"}
{"level":"info","ts":"2026-07-18T14:19:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/89531873a7370a885a34688433ed5e1e96e64d6218ab4dce3cde33eecf99353b"}
{"level":"info","ts":"2026-07-18T14:19:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/c89a67cb33559e71a080fcaf010ba35280b59a50cfe905fa3ef5fe613286d6dd"}
{"level":"info","ts":"2026-07-18T14:19:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/2c6426ed15db90cb8a3481a5ebc6c35b265f5d67ba1f7f32b18aaf4d3383abca"}
{"level":"info","ts":"2026-07-18T14:19:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/7dbbdec4e3cb9a34886a9e998eddfe2e2c2fb1af5463b97754d06d85a0dbdc58"}
{"level":"info","ts":"2026-07-18T14:19:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/d0d33b0a7c5028335a83c16bae5e9fad490fa3cd938e7dd3d6a31ea57df13b32"}
{"level":"info","ts":"2026-07-18T14:19:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/01fb2dc95d235924769d5e8a0a11b906864cfd83c8d037ba19e0a993ce230791"}
{"level":"info","ts":"2026-07-18T14:19:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/da3580851057373fe12a7f462cf4c33856ac453b093e20b48f53a055f857a6ed"}
{"level":"info","ts":"2026-07-18T14:19:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/8b7d10b5c407e3967927cb43daa6aa8acdb69d5fc7b7049b4b34be9495604744"}
{"level":"info","ts":"2026-07-18T14:19:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/d21cf8cb9aea83173e55822919f9153e09a99a1878b155fe5dff03967c2427e7"}
{"level":"info","ts":"2026-07-18T14:19:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/0487ad3ed6bbf7d13afc414982030ed83ea18f0dde1b8a216974f387528f1c6a"}
{"level":"info","ts":"2026-07-18T14:19:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/9034307596e5bb82a70bad8e58726d21f1cb153b29ad1556d836c542afb461dc"}
{"level":"info","ts":"2026-07-18T14:19:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/db90915d6fc00166fc00a8eebd28b13466b4de6c3507b478fe00ccd8abb8820c"}