{"level":"info","ts":"2026-07-13T22:05:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"26f514ea7a80feb2a7a24b3d13358b5314a7ff974fd39b30f4144e13ce15e32d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T22:05:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"26f514ea7a80feb2a7a24b3d13358b5314a7ff974fd39b30f4144e13ce15e32d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T22:05:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"26f514ea7a80feb2a7a24b3d13358b5314a7ff974fd39b30f4144e13ce15e32d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-13T22:05:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/26f514ea7a80feb2a7a24b3d13358b5314a7ff974fd39b30f4144e13ce15e32d"}
{"level":"debug","ts":"2026-07-13T22:05:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"26f514ea7a80feb2a7a24b3d13358b5314a7ff974fd39b30f4144e13ce15e32d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-13T22:05:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/26f514ea7a80feb2a7a24b3d13358b5314a7ff974fd39b30f4144e13ce15e32d"}
{"level":"debug","ts":"2026-07-13T22:05:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"26f514ea7a80feb2a7a24b3d13358b5314a7ff974fd39b30f4144e13ce15e32d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-13T22:05:01Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-13T22:05:01Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["26f514ea7a80feb2a7a24b3d13358b5314a7ff974fd39b30f4144e13ce15e32d"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-13T22:05:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"26f514ea7a80feb2a7a24b3d13358b5314a7ff974fd39b30f4144e13ce15e32d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T22:05:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"26f514ea7a80feb2a7a24b3d13358b5314a7ff974fd39b30f4144e13ce15e32d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-13T22:05:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/26f514ea7a80feb2a7a24b3d13358b5314a7ff974fd39b30f4144e13ce15e32d"}
{"level":"debug","ts":"2026-07-13T22:05:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"fa42c5bb70564658d8402436395fca7bad93e1b4dd7963f558af7a635f11762c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-13T22:05:16Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-13T22:05:16Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-13T22:05:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"fa42c5bb70564658d8402436395fca7bad93e1b4dd7963f558af7a635f11762c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T22:05:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"fa42c5bb70564658d8402436395fca7bad93e1b4dd7963f558af7a635f11762c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-13T22:05:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/fa42c5bb70564658d8402436395fca7bad93e1b4dd7963f558af7a635f11762c"}
{"level":"debug","ts":"2026-07-13T22:05:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"fa42c5bb70564658d8402436395fca7bad93e1b4dd7963f558af7a635f11762c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-13T22:05:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/fa42c5bb70564658d8402436395fca7bad93e1b4dd7963f558af7a635f11762c"}
{"level":"debug","ts":"2026-07-13T22:05:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"fa42c5bb70564658d8402436395fca7bad93e1b4dd7963f558af7a635f11762c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-13T22:05:16Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-13T22:05:16Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["fa42c5bb70564658d8402436395fca7bad93e1b4dd7963f558af7a635f11762c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-13T22:05:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"fa42c5bb70564658d8402436395fca7bad93e1b4dd7963f558af7a635f11762c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T22:05:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"fa42c5bb70564658d8402436395fca7bad93e1b4dd7963f558af7a635f11762c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-13T22:05:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/fa42c5bb70564658d8402436395fca7bad93e1b4dd7963f558af7a635f11762c"}
{"level":"debug","ts":"2026-07-13T22:05:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e0d6e586ea4885531713721da0edd9b3c134f549f35b5f170e0ccfb9c58d39a7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-13T22:05:16Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-13T22:05:16Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-13T22:05:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e0d6e586ea4885531713721da0edd9b3c134f549f35b5f170e0ccfb9c58d39a7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T22:05:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e0d6e586ea4885531713721da0edd9b3c134f549f35b5f170e0ccfb9c58d39a7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T22:05:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e0d6e586ea4885531713721da0edd9b3c134f549f35b5f170e0ccfb9c58d39a7","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-13T22:05:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e0d6e586ea4885531713721da0edd9b3c134f549f35b5f170e0ccfb9c58d39a7"}
{"level":"debug","ts":"2026-07-13T22:05:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e0d6e586ea4885531713721da0edd9b3c134f549f35b5f170e0ccfb9c58d39a7","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-13T22:05:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e0d6e586ea4885531713721da0edd9b3c134f549f35b5f170e0ccfb9c58d39a7"}
{"level":"debug","ts":"2026-07-13T22:05:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e0d6e586ea4885531713721da0edd9b3c134f549f35b5f170e0ccfb9c58d39a7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-13T22:05:16Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-13T22:05:16Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["e0d6e586ea4885531713721da0edd9b3c134f549f35b5f170e0ccfb9c58d39a7"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-13T22:05:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e0d6e586ea4885531713721da0edd9b3c134f549f35b5f170e0ccfb9c58d39a7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T22:05:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e0d6e586ea4885531713721da0edd9b3c134f549f35b5f170e0ccfb9c58d39a7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-13T22:05:16Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-13T22:05:16Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-13T22:05:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e0d6e586ea4885531713721da0edd9b3c134f549f35b5f170e0ccfb9c58d39a7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T22:05:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"818ab780d2764176ece19c9ecf1f4e7b40b318323c07cf46c491e45cd6b2e7cf","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T22:05:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e0d6e586ea4885531713721da0edd9b3c134f549f35b5f170e0ccfb9c58d39a7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T22:05:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e0d6e586ea4885531713721da0edd9b3c134f549f35b5f170e0ccfb9c58d39a7","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-13T22:05:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e0d6e586ea4885531713721da0edd9b3c134f549f35b5f170e0ccfb9c58d39a7"}
{"level":"debug","ts":"2026-07-13T22:05:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e0d6e586ea4885531713721da0edd9b3c134f549f35b5f170e0ccfb9c58d39a7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-13T22:05:16Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-13T22:05:16Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["e0d6e586ea4885531713721da0edd9b3c134f549f35b5f170e0ccfb9c58d39a7"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-13T22:05:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/818ab780d2764176ece19c9ecf1f4e7b40b318323c07cf46c491e45cd6b2e7cf"}
{"level":"info","ts":"2026-07-13T22:05:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e0d6e586ea4885531713721da0edd9b3c134f549f35b5f170e0ccfb9c58d39a7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T22:05:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e0d6e586ea4885531713721da0edd9b3c134f549f35b5f170e0ccfb9c58d39a7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-13T22:05:16Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-13T22:05:16Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-13T22:05:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e0d6e586ea4885531713721da0edd9b3c134f549f35b5f170e0ccfb9c58d39a7"}
{"level":"info","ts":"2026-07-13T22:05:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e0d6e586ea4885531713721da0edd9b3c134f549f35b5f170e0ccfb9c58d39a7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T22:05:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e0d6e586ea4885531713721da0edd9b3c134f549f35b5f170e0ccfb9c58d39a7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T22:05:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e0d6e586ea4885531713721da0edd9b3c134f549f35b5f170e0ccfb9c58d39a7","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-13T22:05:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e0d6e586ea4885531713721da0edd9b3c134f549f35b5f170e0ccfb9c58d39a7"}
{"level":"debug","ts":"2026-07-13T22:05:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e0d6e586ea4885531713721da0edd9b3c134f549f35b5f170e0ccfb9c58d39a7","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-13T22:05:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e0d6e586ea4885531713721da0edd9b3c134f549f35b5f170e0ccfb9c58d39a7"}
{"level":"debug","ts":"2026-07-13T22:05:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1e3bc616bd25180dab289dfe783b0af541d34299d1ea0b2a4f0bcad14cf68615","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-13T22:05:16Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-13T22:05:16Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-13T22:05:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1e3bc616bd25180dab289dfe783b0af541d34299d1ea0b2a4f0bcad14cf68615","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T22:05:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1e3bc616bd25180dab289dfe783b0af541d34299d1ea0b2a4f0bcad14cf68615","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T22:05:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1e3bc616bd25180dab289dfe783b0af541d34299d1ea0b2a4f0bcad14cf68615","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-13T22:05:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1e3bc616bd25180dab289dfe783b0af541d34299d1ea0b2a4f0bcad14cf68615"}
{"level":"debug","ts":"2026-07-13T22:05:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e0d6e586ea4885531713721da0edd9b3c134f549f35b5f170e0ccfb9c58d39a7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-13T22:05:16Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-13T22:05:16Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["e0d6e586ea4885531713721da0edd9b3c134f549f35b5f170e0ccfb9c58d39a7"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-13T22:05:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e0d6e586ea4885531713721da0edd9b3c134f549f35b5f170e0ccfb9c58d39a7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T22:05:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1e3bc616bd25180dab289dfe783b0af541d34299d1ea0b2a4f0bcad14cf68615","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T22:05:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e0d6e586ea4885531713721da0edd9b3c134f549f35b5f170e0ccfb9c58d39a7","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-13T22:05:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1e3bc616bd25180dab289dfe783b0af541d34299d1ea0b2a4f0bcad14cf68615"}
{"level":"info","ts":"2026-07-13T22:05:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e0d6e586ea4885531713721da0edd9b3c134f549f35b5f170e0ccfb9c58d39a7"}
{"level":"debug","ts":"2026-07-13T22:05:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1e3bc616bd25180dab289dfe783b0af541d34299d1ea0b2a4f0bcad14cf68615","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-13T22:05:16Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-13T22:05:16Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["1e3bc616bd25180dab289dfe783b0af541d34299d1ea0b2a4f0bcad14cf68615"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-13T22:05:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1e3bc616bd25180dab289dfe783b0af541d34299d1ea0b2a4f0bcad14cf68615","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T22:05:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1e3bc616bd25180dab289dfe783b0af541d34299d1ea0b2a4f0bcad14cf68615","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-13T22:05:16Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-13T22:05:16Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-13T22:05:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1e3bc616bd25180dab289dfe783b0af541d34299d1ea0b2a4f0bcad14cf68615","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T22:05:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0d186e759965f9293385c5eb1fe6850f50cc021f99cf5da64ce565bb553c3e39","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T22:05:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1e3bc616bd25180dab289dfe783b0af541d34299d1ea0b2a4f0bcad14cf68615","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T22:05:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1e3bc616bd25180dab289dfe783b0af541d34299d1ea0b2a4f0bcad14cf68615","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-13T22:05:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1e3bc616bd25180dab289dfe783b0af541d34299d1ea0b2a4f0bcad14cf68615"}
{"level":"debug","ts":"2026-07-13T22:05:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1e3bc616bd25180dab289dfe783b0af541d34299d1ea0b2a4f0bcad14cf68615","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-13T22:05:16Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-13T22:05:16Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["1e3bc616bd25180dab289dfe783b0af541d34299d1ea0b2a4f0bcad14cf68615"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-13T22:05:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0d186e759965f9293385c5eb1fe6850f50cc021f99cf5da64ce565bb553c3e39"}
{"level":"info","ts":"2026-07-13T22:05:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1e3bc616bd25180dab289dfe783b0af541d34299d1ea0b2a4f0bcad14cf68615","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T22:05:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1e3bc616bd25180dab289dfe783b0af541d34299d1ea0b2a4f0bcad14cf68615","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-13T22:05:16Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-13T22:05:16Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-13T22:05:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1e3bc616bd25180dab289dfe783b0af541d34299d1ea0b2a4f0bcad14cf68615"}
{"level":"info","ts":"2026-07-13T22:05:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1e3bc616bd25180dab289dfe783b0af541d34299d1ea0b2a4f0bcad14cf68615","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T22:05:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1e3bc616bd25180dab289dfe783b0af541d34299d1ea0b2a4f0bcad14cf68615","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T22:05:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1e3bc616bd25180dab289dfe783b0af541d34299d1ea0b2a4f0bcad14cf68615","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-13T22:05:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1e3bc616bd25180dab289dfe783b0af541d34299d1ea0b2a4f0bcad14cf68615"}
{"level":"debug","ts":"2026-07-13T22:05:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1e3bc616bd25180dab289dfe783b0af541d34299d1ea0b2a4f0bcad14cf68615","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T22:05:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1e3bc616bd25180dab289dfe783b0af541d34299d1ea0b2a4f0bcad14cf68615","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-13T22:05:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1e3bc616bd25180dab289dfe783b0af541d34299d1ea0b2a4f0bcad14cf68615"}
{"level":"debug","ts":"2026-07-13T22:05:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1e3bc616bd25180dab289dfe783b0af541d34299d1ea0b2a4f0bcad14cf68615","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-13T22:05:16Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-13T22:05:16Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["1e3bc616bd25180dab289dfe783b0af541d34299d1ea0b2a4f0bcad14cf68615"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-13T22:05:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1e3bc616bd25180dab289dfe783b0af541d34299d1ea0b2a4f0bcad14cf68615","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T22:05:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1e3bc616bd25180dab289dfe783b0af541d34299d1ea0b2a4f0bcad14cf68615","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-13T22:05:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1e3bc616bd25180dab289dfe783b0af541d34299d1ea0b2a4f0bcad14cf68615"}
{"level":"debug","ts":"2026-07-13T22:05:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5bc3d0e6e4c90831623f909e8135e6a93f30e70e9ae8b85f52efecfad84c4bcf","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-13T22:05:16Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-13T22:05:16Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-13T22:05:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5bc3d0e6e4c90831623f909e8135e6a93f30e70e9ae8b85f52efecfad84c4bcf","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T22:05:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5bc3d0e6e4c90831623f909e8135e6a93f30e70e9ae8b85f52efecfad84c4bcf","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T22:05:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5bc3d0e6e4c90831623f909e8135e6a93f30e70e9ae8b85f52efecfad84c4bcf","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-13T22:05:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5bc3d0e6e4c90831623f909e8135e6a93f30e70e9ae8b85f52efecfad84c4bcf"}
{"level":"debug","ts":"2026-07-13T22:05:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5bc3d0e6e4c90831623f909e8135e6a93f30e70e9ae8b85f52efecfad84c4bcf","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-13T22:05:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5bc3d0e6e4c90831623f909e8135e6a93f30e70e9ae8b85f52efecfad84c4bcf"}
{"level":"debug","ts":"2026-07-13T22:05:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5bc3d0e6e4c90831623f909e8135e6a93f30e70e9ae8b85f52efecfad84c4bcf","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-13T22:05:16Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-13T22:05:16Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["5bc3d0e6e4c90831623f909e8135e6a93f30e70e9ae8b85f52efecfad84c4bcf"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-13T22:05:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5bc3d0e6e4c90831623f909e8135e6a93f30e70e9ae8b85f52efecfad84c4bcf","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T22:05:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5bc3d0e6e4c90831623f909e8135e6a93f30e70e9ae8b85f52efecfad84c4bcf","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-13T22:05:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5bc3d0e6e4c90831623f909e8135e6a93f30e70e9ae8b85f52efecfad84c4bcf"}
{"level":"debug","ts":"2026-07-13T22:05:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"16f161b9726293de06d5feccc12eb5b1bb8b6cd2d8428c33e42c8cdf9d20ec73","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-13T22:05:16Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-13T22:05:16Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-13T22:05:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"16f161b9726293de06d5feccc12eb5b1bb8b6cd2d8428c33e42c8cdf9d20ec73","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T22:05:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"16f161b9726293de06d5feccc12eb5b1bb8b6cd2d8428c33e42c8cdf9d20ec73","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T22:05:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"16f161b9726293de06d5feccc12eb5b1bb8b6cd2d8428c33e42c8cdf9d20ec73","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-13T22:05:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/16f161b9726293de06d5feccc12eb5b1bb8b6cd2d8428c33e42c8cdf9d20ec73"}
{"level":"debug","ts":"2026-07-13T22:05:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"16f161b9726293de06d5feccc12eb5b1bb8b6cd2d8428c33e42c8cdf9d20ec73","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-13T22:05:16Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/16f161b9726293de06d5feccc12eb5b1bb8b6cd2d8428c33e42c8cdf9d20ec73"}
{"level":"debug","ts":"2026-07-13T22:05:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"16f161b9726293de06d5feccc12eb5b1bb8b6cd2d8428c33e42c8cdf9d20ec73","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-13T22:05:17Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-13T22:05:17Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["16f161b9726293de06d5feccc12eb5b1bb8b6cd2d8428c33e42c8cdf9d20ec73"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-13T22:05:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"16f161b9726293de06d5feccc12eb5b1bb8b6cd2d8428c33e42c8cdf9d20ec73","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T22:05:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"16f161b9726293de06d5feccc12eb5b1bb8b6cd2d8428c33e42c8cdf9d20ec73","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-13T22:05:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/16f161b9726293de06d5feccc12eb5b1bb8b6cd2d8428c33e42c8cdf9d20ec73"}
{"level":"debug","ts":"2026-07-13T22:05:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"34ed45eff00a4c79d2ecaec0ec5430a7675699ac55c01f2c39ac67aa17a42a82","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-13T22:05:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/34ed45eff00a4c79d2ecaec0ec5430a7675699ac55c01f2c39ac67aa17a42a82"}
{"level":"debug","ts":"2026-07-13T22:05:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ed6a46de873ae8893b3b021c2e814928055ceed50524a161241b223fa68e3177","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-13T22:05:17Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-13T22:05:17Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-13T22:05:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ed6a46de873ae8893b3b021c2e814928055ceed50524a161241b223fa68e3177","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T22:05:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ed6a46de873ae8893b3b021c2e814928055ceed50524a161241b223fa68e3177","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T22:05:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f0c7d4c9512c4f722b661d3b38e1940f7cf7a560b37c02f44db744282622baca","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T22:05:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ed6a46de873ae8893b3b021c2e814928055ceed50524a161241b223fa68e3177","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-13T22:05:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ed6a46de873ae8893b3b021c2e814928055ceed50524a161241b223fa68e3177"}
{"level":"debug","ts":"2026-07-13T22:05:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"04055b703f60a314c8f7af342b6f1e128948f097215a0711463b43bcb5fb747a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T22:05:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ed6a46de873ae8893b3b021c2e814928055ceed50524a161241b223fa68e3177","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-13T22:05:17Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-13T22:05:17Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["ed6a46de873ae8893b3b021c2e814928055ceed50524a161241b223fa68e3177"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-13T22:05:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f0c7d4c9512c4f722b661d3b38e1940f7cf7a560b37c02f44db744282622baca"}
{"level":"info","ts":"2026-07-13T22:05:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ed6a46de873ae8893b3b021c2e814928055ceed50524a161241b223fa68e3177","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T22:05:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ed6a46de873ae8893b3b021c2e814928055ceed50524a161241b223fa68e3177","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-13T22:05:17Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-13T22:05:17Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-13T22:05:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ed6a46de873ae8893b3b021c2e814928055ceed50524a161241b223fa68e3177"}
{"level":"info","ts":"2026-07-13T22:05:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ed6a46de873ae8893b3b021c2e814928055ceed50524a161241b223fa68e3177","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T22:05:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ed6a46de873ae8893b3b021c2e814928055ceed50524a161241b223fa68e3177","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-13T22:05:17Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-13T22:05:17Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["ed6a46de873ae8893b3b021c2e814928055ceed50524a161241b223fa68e3177"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-13T22:05:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/04055b703f60a314c8f7af342b6f1e128948f097215a0711463b43bcb5fb747a"}
{"level":"info","ts":"2026-07-13T22:05:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ed6a46de873ae8893b3b021c2e814928055ceed50524a161241b223fa68e3177","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T22:05:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ed6a46de873ae8893b3b021c2e814928055ceed50524a161241b223fa68e3177","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-13T22:05:17Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-13T22:05:17Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-13T22:05:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ed6a46de873ae8893b3b021c2e814928055ceed50524a161241b223fa68e3177"}
{"level":"info","ts":"2026-07-13T22:05:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ed6a46de873ae8893b3b021c2e814928055ceed50524a161241b223fa68e3177"}
{"level":"info","ts":"2026-07-13T22:05:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ed6a46de873ae8893b3b021c2e814928055ceed50524a161241b223fa68e3177","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T22:05:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ed6a46de873ae8893b3b021c2e814928055ceed50524a161241b223fa68e3177","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T22:05:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ed6a46de873ae8893b3b021c2e814928055ceed50524a161241b223fa68e3177","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-13T22:05:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ed6a46de873ae8893b3b021c2e814928055ceed50524a161241b223fa68e3177"}
{"level":"debug","ts":"2026-07-13T22:05:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ed6a46de873ae8893b3b021c2e814928055ceed50524a161241b223fa68e3177","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-13T22:05:17Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-13T22:05:17Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["ed6a46de873ae8893b3b021c2e814928055ceed50524a161241b223fa68e3177"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-13T22:05:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/26f514ea7a80feb2a7a24b3d13358b5314a7ff974fd39b30f4144e13ce15e32d"}
{"level":"info","ts":"2026-07-13T22:05:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ed6a46de873ae8893b3b021c2e814928055ceed50524a161241b223fa68e3177","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T22:05:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"26f514ea7a80feb2a7a24b3d13358b5314a7ff974fd39b30f4144e13ce15e32d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T22:05:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0230fb385edd493d79e05ed9c0cd0e63570c9dd1784f0711f305a3aa3d199cf2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-13T22:05:17Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-13T22:05:17Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-13T22:05:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0230fb385edd493d79e05ed9c0cd0e63570c9dd1784f0711f305a3aa3d199cf2"}
{"level":"info","ts":"2026-07-13T22:05:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ed6a46de873ae8893b3b021c2e814928055ceed50524a161241b223fa68e3177"}
{"level":"info","ts":"2026-07-13T22:05:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0230fb385edd493d79e05ed9c0cd0e63570c9dd1784f0711f305a3aa3d199cf2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T22:05:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ed6a46de873ae8893b3b021c2e814928055ceed50524a161241b223fa68e3177","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T22:05:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9921a4c4e184cb4ffac68872cc995101abafde232a72376d09e2704c1cb8f99f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-13T22:05:17Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-13T22:05:17Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-13T22:05:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9921a4c4e184cb4ffac68872cc995101abafde232a72376d09e2704c1cb8f99f"}
{"level":"info","ts":"2026-07-13T22:05:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9921a4c4e184cb4ffac68872cc995101abafde232a72376d09e2704c1cb8f99f","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-13T22:05:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0230fb385edd493d79e05ed9c0cd0e63570c9dd1784f0711f305a3aa3d199cf2"}
{"level":"debug","ts":"2026-07-13T22:05:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0230fb385edd493d79e05ed9c0cd0e63570c9dd1784f0711f305a3aa3d199cf2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-13T22:05:17Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-13T22:05:17Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["0230fb385edd493d79e05ed9c0cd0e63570c9dd1784f0711f305a3aa3d199cf2"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-13T22:05:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f59f9659af28bf41d9f2caebef09ed29f1091dc1e22376ac3cf25896f1144ec8"}
{"level":"info","ts":"2026-07-13T22:05:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0230fb385edd493d79e05ed9c0cd0e63570c9dd1784f0711f305a3aa3d199cf2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T22:05:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f59f9659af28bf41d9f2caebef09ed29f1091dc1e22376ac3cf25896f1144ec8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T22:05:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9921a4c4e184cb4ffac68872cc995101abafde232a72376d09e2704c1cb8f99f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T22:05:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a111fc3e0459c1e24b0be2150a28d7278948be5db3a78f4ffd9838322e0b865e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T22:05:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0230fb385edd493d79e05ed9c0cd0e63570c9dd1784f0711f305a3aa3d199cf2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T22:05:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9921a4c4e184cb4ffac68872cc995101abafde232a72376d09e2704c1cb8f99f","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-13T22:05:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9921a4c4e184cb4ffac68872cc995101abafde232a72376d09e2704c1cb8f99f"}
{"level":"debug","ts":"2026-07-13T22:05:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9cf5673fe4fc5526bac69b374c3a0a3a238796dda7cd3ac3e96e26677eb6bf72","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T22:05:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9921a4c4e184cb4ffac68872cc995101abafde232a72376d09e2704c1cb8f99f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-13T22:05:17Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-13T22:05:17Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["9921a4c4e184cb4ffac68872cc995101abafde232a72376d09e2704c1cb8f99f"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-13T22:05:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a111fc3e0459c1e24b0be2150a28d7278948be5db3a78f4ffd9838322e0b865e"}
{"level":"info","ts":"2026-07-13T22:05:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9921a4c4e184cb4ffac68872cc995101abafde232a72376d09e2704c1cb8f99f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T22:05:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"29cd70821b77bbedb334f60a15f77a0d8fcd1f81d3affd7f45cfe64115cbda76","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T22:05:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9921a4c4e184cb4ffac68872cc995101abafde232a72376d09e2704c1cb8f99f","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-13T22:05:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0230fb385edd493d79e05ed9c0cd0e63570c9dd1784f0711f305a3aa3d199cf2"}
{"level":"debug","ts":"2026-07-13T22:05:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d504298d6fb8dfda9dc21a6bc9bfdb9755d81cd5b9a467d2fa0bf9204ef7fc36","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-13T22:05:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9cf5673fe4fc5526bac69b374c3a0a3a238796dda7cd3ac3e96e26677eb6bf72"}
{"level":"debug","ts":"2026-07-13T22:05:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e530e68565d7c3478114a12b60d84aab3e363eda127255ff3d157697d2142a14","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-13T22:05:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5f66e0467e508d4810641b779ccd0fd373a79eade0600c330831cf09869023b7","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-13T22:05:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/29cd70821b77bbedb334f60a15f77a0d8fcd1f81d3affd7f45cfe64115cbda76"}
{"level":"debug","ts":"2026-07-13T22:05:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"eaca0db86e69c9967785c4cc0b9ab92cd6fcdc7a3ed0f57ff9027604ee70437c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-13T22:05:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9921a4c4e184cb4ffac68872cc995101abafde232a72376d09e2704c1cb8f99f"}
{"level":"debug","ts":"2026-07-13T22:05:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2b42933b786984f30f6aea746c55ab3a825b967fe78da31a3bdc9ba0b2b2d2b6","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-13T22:05:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d504298d6fb8dfda9dc21a6bc9bfdb9755d81cd5b9a467d2fa0bf9204ef7fc36"}
{"level":"debug","ts":"2026-07-13T22:05:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"bc81350bd84dc07a39b4c9cd86fdcebfd5d5680689d2911bdead7cf109ac0cce","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-13T22:05:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e530e68565d7c3478114a12b60d84aab3e363eda127255ff3d157697d2142a14"}
{"level":"info","ts":"2026-07-13T22:05:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5f66e0467e508d4810641b779ccd0fd373a79eade0600c330831cf09869023b7"}
{"level":"info","ts":"2026-07-13T22:05:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/eaca0db86e69c9967785c4cc0b9ab92cd6fcdc7a3ed0f57ff9027604ee70437c"}
{"level":"info","ts":"2026-07-13T22:05:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2b42933b786984f30f6aea746c55ab3a825b967fe78da31a3bdc9ba0b2b2d2b6"}
{"level":"info","ts":"2026-07-13T22:05:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/bc81350bd84dc07a39b4c9cd86fdcebfd5d5680689d2911bdead7cf109ac0cce"}
{"level":"info","ts":"2026-07-13T22:05:18Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"facf7868-91c6-4733-8eb6-d054a5022a31","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:57472","PortSpecifier":{"PortValue":57472}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.64:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"facf7868-91c6-4733-8eb6-d054a5022a31","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-44ef67.apps.90cdb254-0673-4cb5-829b-399056712c87.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-13T22:05:18Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"facf7868-91c6-4733-8eb6-d054a5022a31","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:57472","PortSpecifier":{"PortValue":57472}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.64:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783980318,"nanos":950532580},"http":{"id":"facf7868-91c6-4733-8eb6-d054a5022a31","method":"POST","headers":{":authority":"e2e-shared-a-44ef67.apps.90cdb254-0673-4cb5-829b-399056712c87.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-13T22:05:18Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"facf7868-91c6-4733-8eb6-d054a5022a31","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-13T22:05:18Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"facf7868-91c6-4733-8eb6-d054a5022a31","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"1a1f8564-e973-41ed-bd55-3911e95c06f8","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=690d4199-87db-4410-9a8b-f9bbbfc4eb8a"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/399056712c87"]}}
{"level":"debug","ts":"2026-07-13T22:05:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"facf7868-91c6-4733-8eb6-d054a5022a31","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/399056712c87"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=690d4199-87db-4410-9a8b-f9bbbfc4eb8a"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"1a1f8564-e973-41ed-bd55-3911e95c06f8","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"5bc3d0e6e4c90831623f909e8135e6a93f30e70e9ae8b85f52efecfad84c4bcf"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.64:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-44ef67.apps.90cdb254-0673-4cb5-829b-399056712c87.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-13T22:05:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"facf7868-91c6-4733-8eb6-d054a5022a31","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T22:05:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"facf7868-91c6-4733-8eb6-d054a5022a31","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T22:05:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"facf7868-91c6-4733-8eb6-d054a5022a31","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-44ef67/rate-test-model-44ef67\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-44ef67/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T22:05:18Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"facf7868-91c6-4733-8eb6-d054a5022a31","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-13T22:05:18Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"facf7868-91c6-4733-8eb6-d054a5022a31","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-13T22:05:18Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"facf7868-91c6-4733-8eb6-d054a5022a31","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-13T22:05:18Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"facf7868-91c6-4733-8eb6-d054a5022a31","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-13T22:05:18Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"facf7868-91c6-4733-8eb6-d054a5022a31","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-13T22:05:18Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"229e230c-90df-4430-b561-27adb2eb335b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:49996","PortSpecifier":{"PortValue":49996}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.66:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"229e230c-90df-4430-b561-27adb2eb335b","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-f0e328.apps.90cdb254-0673-4cb5-829b-399056712c87.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-13T22:05:18Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"229e230c-90df-4430-b561-27adb2eb335b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:49996","PortSpecifier":{"PortValue":49996}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.66:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783980318,"nanos":989234740},"http":{"id":"229e230c-90df-4430-b561-27adb2eb335b","method":"POST","headers":{":authority":"e2e-shared-b-f0e328.apps.90cdb254-0673-4cb5-829b-399056712c87.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-13T22:05:18Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"229e230c-90df-4430-b561-27adb2eb335b","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-13T22:05:18Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"229e230c-90df-4430-b561-27adb2eb335b","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"1a1f8564-e973-41ed-bd55-3911e95c06f8","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=690d4199-87db-4410-9a8b-f9bbbfc4eb8a"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/399056712c87"]}}
{"level":"debug","ts":"2026-07-13T22:05:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"229e230c-90df-4430-b561-27adb2eb335b","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/399056712c87"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=690d4199-87db-4410-9a8b-f9bbbfc4eb8a"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"1a1f8564-e973-41ed-bd55-3911e95c06f8","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"2b42933b786984f30f6aea746c55ab3a825b967fe78da31a3bdc9ba0b2b2d2b6"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.66:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-f0e328.apps.90cdb254-0673-4cb5-829b-399056712c87.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-13T22:05:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"229e230c-90df-4430-b561-27adb2eb335b","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T22:05:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"229e230c-90df-4430-b561-27adb2eb335b","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T22:05:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"229e230c-90df-4430-b561-27adb2eb335b","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-f0e328/rate-test-model-f0e328\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-f0e328/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T22:05:18Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"229e230c-90df-4430-b561-27adb2eb335b","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-13T22:05:18Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"229e230c-90df-4430-b561-27adb2eb335b","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-13T22:05:18Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"229e230c-90df-4430-b561-27adb2eb335b","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-13T22:05:18Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"229e230c-90df-4430-b561-27adb2eb335b","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-13T22:05:18Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"229e230c-90df-4430-b561-27adb2eb335b","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-13T22:05:19Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2522d55b-8531-4adf-8985-112cee291015","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:57480","PortSpecifier":{"PortValue":57480}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.64:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"2522d55b-8531-4adf-8985-112cee291015","method":"POST","path":"/ai-tenant-e2e-shared-a-44ef67/rate-test-model-44ef67/v1/completions","host":"e2e-shared-a-44ef67.apps.90cdb254-0673-4cb5-829b-399056712c87.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-13T22:05:19Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2522d55b-8531-4adf-8985-112cee291015","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:57480","PortSpecifier":{"PortValue":57480}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.64:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783980319,"nanos":25226996},"http":{"id":"2522d55b-8531-4adf-8985-112cee291015","method":"POST","headers":{":authority":"e2e-shared-a-44ef67.apps.90cdb254-0673-4cb5-829b-399056712c87.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-44ef67/rate-test-model-44ef67/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-13T22:05:19Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"2522d55b-8531-4adf-8985-112cee291015","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-SMILcKvvfu6AKIey_PKJUtffjTAypiCQnhd8lxTVISEhfjKEXXuGXPorb0v2"}
{"level":"debug","ts":"2026-07-13T22:05:19Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"2522d55b-8531-4adf-8985-112cee291015","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-44ef67.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-SMILcKvvfu6AKIey_PKJUtffjTAypiCQnhd8lxTVISEhfjKEXXuGXPorb0v2\"}"}
{"level":"debug","ts":"2026-07-13T22:05:19Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"2522d55b-8531-4adf-8985-112cee291015","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-44ef67.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"af92626e-10dc-43f3-8c29-a75caf000fb8","keyName":"e2e-rate-a-ee7429","subscription":"e2e-rate-iso-a-ee7429","tenant":"e2e-shared-a-44ef67","userId":"af92626e-10dc-43f3-8c29-a75caf000fb8","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-13T22:05:19Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"2522d55b-8531-4adf-8985-112cee291015","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-44ef67.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-44ef67/rate-test-model-44ef67\",\"requestedSubscription\":\"e2e-rate-iso-a-ee7429\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-13T22:05:19Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"2522d55b-8531-4adf-8985-112cee291015","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-44ef67.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-44ef67","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-ee7429","namespace":"ai-tenant-e2e-shared-a-44ef67","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-13T22:05:19Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"2522d55b-8531-4adf-8985-112cee291015","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-13T22:05:19Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2522d55b-8531-4adf-8985-112cee291015","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T22:05:19Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2522d55b-8531-4adf-8985-112cee291015","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T22:05:19Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2522d55b-8531-4adf-8985-112cee291015","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-44ef67/rate-test-model-44ef67\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-44ef67/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T22:05:19Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2522d55b-8531-4adf-8985-112cee291015","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T22:05:19Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2522d55b-8531-4adf-8985-112cee291015","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-ee7429"}
{"level":"debug","ts":"2026-07-13T22:05:19Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2522d55b-8531-4adf-8985-112cee291015","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-13T22:05:19Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2522d55b-8531-4adf-8985-112cee291015","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-13T22:05:19Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2522d55b-8531-4adf-8985-112cee291015","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"af92626e-10dc-43f3-8c29-a75caf000fb8","keyName":"e2e-rate-a-ee7429","selected_subscription":"e2e-rate-iso-a-ee7429","selected_subscription_key":"ai-tenant-e2e-shared-a-44ef67/e2e-rate-iso-a-ee7429@ai-tenant-e2e-shared-a-44ef67/rate-test-model-44ef67","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-44ef67","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-ee7429","namespace":"ai-tenant-e2e-shared-a-44ef67","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-13T22:05:19Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2522d55b-8531-4adf-8985-112cee291015","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-13T22:05:19Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2522d55b-8531-4adf-8985-112cee291015","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-13T22:05:20Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"13bc63da-f14d-4252-8134-e44c6a46d02e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:57486","PortSpecifier":{"PortValue":57486}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.64:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"13bc63da-f14d-4252-8134-e44c6a46d02e","method":"POST","path":"/ai-tenant-e2e-shared-a-44ef67/rate-test-model-44ef67/v1/completions","host":"e2e-shared-a-44ef67.apps.90cdb254-0673-4cb5-829b-399056712c87.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-13T22:05:20Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"13bc63da-f14d-4252-8134-e44c6a46d02e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:57486","PortSpecifier":{"PortValue":57486}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.64:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783980320,"nanos":74725740},"http":{"id":"13bc63da-f14d-4252-8134-e44c6a46d02e","method":"POST","headers":{":authority":"e2e-shared-a-44ef67.apps.90cdb254-0673-4cb5-829b-399056712c87.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-44ef67/rate-test-model-44ef67/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-13T22:05:20Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"13bc63da-f14d-4252-8134-e44c6a46d02e","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-SMILcKvvfu6AKIey_PKJUtffjTAypiCQnhd8lxTVISEhfjKEXXuGXPorb0v2"}
{"level":"debug","ts":"2026-07-13T22:05:20Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"13bc63da-f14d-4252-8134-e44c6a46d02e","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-44ef67.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-SMILcKvvfu6AKIey_PKJUtffjTAypiCQnhd8lxTVISEhfjKEXXuGXPorb0v2\"}"}
{"level":"debug","ts":"2026-07-13T22:05:20Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"13bc63da-f14d-4252-8134-e44c6a46d02e","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-44ef67.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"af92626e-10dc-43f3-8c29-a75caf000fb8","keyName":"e2e-rate-a-ee7429","subscription":"e2e-rate-iso-a-ee7429","tenant":"e2e-shared-a-44ef67","userId":"af92626e-10dc-43f3-8c29-a75caf000fb8","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-13T22:05:20Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"13bc63da-f14d-4252-8134-e44c6a46d02e","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-44ef67.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-44ef67/rate-test-model-44ef67\",\"requestedSubscription\":\"e2e-rate-iso-a-ee7429\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-13T22:05:20Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"13bc63da-f14d-4252-8134-e44c6a46d02e","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-44ef67.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-44ef67","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-ee7429","namespace":"ai-tenant-e2e-shared-a-44ef67","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-13T22:05:20Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"13bc63da-f14d-4252-8134-e44c6a46d02e","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-13T22:05:20Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"13bc63da-f14d-4252-8134-e44c6a46d02e","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T22:05:20Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"13bc63da-f14d-4252-8134-e44c6a46d02e","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T22:05:20Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"13bc63da-f14d-4252-8134-e44c6a46d02e","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-44ef67/rate-test-model-44ef67\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-44ef67/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T22:05:20Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"13bc63da-f14d-4252-8134-e44c6a46d02e","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T22:05:20Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"13bc63da-f14d-4252-8134-e44c6a46d02e","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-ee7429"}
{"level":"debug","ts":"2026-07-13T22:05:20Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"13bc63da-f14d-4252-8134-e44c6a46d02e","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-13T22:05:20Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"13bc63da-f14d-4252-8134-e44c6a46d02e","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-13T22:05:20Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"13bc63da-f14d-4252-8134-e44c6a46d02e","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"af92626e-10dc-43f3-8c29-a75caf000fb8","keyName":"e2e-rate-a-ee7429","selected_subscription":"e2e-rate-iso-a-ee7429","selected_subscription_key":"ai-tenant-e2e-shared-a-44ef67/e2e-rate-iso-a-ee7429@ai-tenant-e2e-shared-a-44ef67/rate-test-model-44ef67","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-44ef67","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-ee7429","namespace":"ai-tenant-e2e-shared-a-44ef67","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-13T22:05:20Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"13bc63da-f14d-4252-8134-e44c6a46d02e","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-13T22:05:20Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"13bc63da-f14d-4252-8134-e44c6a46d02e","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-13T22:05:21Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"013e932a-43e6-45bd-bcf0-5a9bf6b3bfce","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:57498","PortSpecifier":{"PortValue":57498}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.64:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"013e932a-43e6-45bd-bcf0-5a9bf6b3bfce","method":"POST","path":"/ai-tenant-e2e-shared-a-44ef67/rate-test-model-44ef67/v1/completions","host":"e2e-shared-a-44ef67.apps.90cdb254-0673-4cb5-829b-399056712c87.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-13T22:05:21Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"013e932a-43e6-45bd-bcf0-5a9bf6b3bfce","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:57498","PortSpecifier":{"PortValue":57498}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.64:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783980321,"nanos":111758748},"http":{"id":"013e932a-43e6-45bd-bcf0-5a9bf6b3bfce","method":"POST","headers":{":authority":"e2e-shared-a-44ef67.apps.90cdb254-0673-4cb5-829b-399056712c87.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-44ef67/rate-test-model-44ef67/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-13T22:05:21Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"013e932a-43e6-45bd-bcf0-5a9bf6b3bfce","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-SMILcKvvfu6AKIey_PKJUtffjTAypiCQnhd8lxTVISEhfjKEXXuGXPorb0v2"}
{"level":"debug","ts":"2026-07-13T22:05:21Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"013e932a-43e6-45bd-bcf0-5a9bf6b3bfce","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-44ef67.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-SMILcKvvfu6AKIey_PKJUtffjTAypiCQnhd8lxTVISEhfjKEXXuGXPorb0v2\"}"}
{"level":"debug","ts":"2026-07-13T22:05:21Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"013e932a-43e6-45bd-bcf0-5a9bf6b3bfce","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-44ef67.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"af92626e-10dc-43f3-8c29-a75caf000fb8","keyName":"e2e-rate-a-ee7429","subscription":"e2e-rate-iso-a-ee7429","tenant":"e2e-shared-a-44ef67","userId":"af92626e-10dc-43f3-8c29-a75caf000fb8","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-13T22:05:21Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"013e932a-43e6-45bd-bcf0-5a9bf6b3bfce","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-44ef67.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-44ef67/rate-test-model-44ef67\",\"requestedSubscription\":\"e2e-rate-iso-a-ee7429\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-13T22:05:21Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"013e932a-43e6-45bd-bcf0-5a9bf6b3bfce","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-44ef67.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-44ef67","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-ee7429","namespace":"ai-tenant-e2e-shared-a-44ef67","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-13T22:05:21Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"013e932a-43e6-45bd-bcf0-5a9bf6b3bfce","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-13T22:05:21Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"013e932a-43e6-45bd-bcf0-5a9bf6b3bfce","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T22:05:21Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"013e932a-43e6-45bd-bcf0-5a9bf6b3bfce","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T22:05:21Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"013e932a-43e6-45bd-bcf0-5a9bf6b3bfce","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-44ef67/rate-test-model-44ef67\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-44ef67/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T22:05:21Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"013e932a-43e6-45bd-bcf0-5a9bf6b3bfce","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T22:05:21Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"013e932a-43e6-45bd-bcf0-5a9bf6b3bfce","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-13T22:05:21Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"013e932a-43e6-45bd-bcf0-5a9bf6b3bfce","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-13T22:05:21Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"013e932a-43e6-45bd-bcf0-5a9bf6b3bfce","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-ee7429"}
{"level":"debug","ts":"2026-07-13T22:05:21Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"013e932a-43e6-45bd-bcf0-5a9bf6b3bfce","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"af92626e-10dc-43f3-8c29-a75caf000fb8","keyName":"e2e-rate-a-ee7429","selected_subscription":"e2e-rate-iso-a-ee7429","selected_subscription_key":"ai-tenant-e2e-shared-a-44ef67/e2e-rate-iso-a-ee7429@ai-tenant-e2e-shared-a-44ef67/rate-test-model-44ef67","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-44ef67","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-ee7429","namespace":"ai-tenant-e2e-shared-a-44ef67","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-13T22:05:21Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"013e932a-43e6-45bd-bcf0-5a9bf6b3bfce","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-13T22:05:21Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"013e932a-43e6-45bd-bcf0-5a9bf6b3bfce","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-13T22:05:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"df7704d4-4536-48c2-bc8d-dc745bca8cbd","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:57944","PortSpecifier":{"PortValue":57944}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.64:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"df7704d4-4536-48c2-bc8d-dc745bca8cbd","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-44ef67.apps.90cdb254-0673-4cb5-829b-399056712c87.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-13T22:05:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"df7704d4-4536-48c2-bc8d-dc745bca8cbd","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:57944","PortSpecifier":{"PortValue":57944}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.64:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783980329,"nanos":691070568},"http":{"id":"df7704d4-4536-48c2-bc8d-dc745bca8cbd","method":"POST","headers":{":authority":"e2e-shared-a-44ef67.apps.90cdb254-0673-4cb5-829b-399056712c87.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-13T22:05:29Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"df7704d4-4536-48c2-bc8d-dc745bca8cbd","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-13T22:05:29Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"df7704d4-4536-48c2-bc8d-dc745bca8cbd","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"1a1f8564-e973-41ed-bd55-3911e95c06f8","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=690d4199-87db-4410-9a8b-f9bbbfc4eb8a"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/399056712c87"]}}
{"level":"debug","ts":"2026-07-13T22:05:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"df7704d4-4536-48c2-bc8d-dc745bca8cbd","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/399056712c87"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=690d4199-87db-4410-9a8b-f9bbbfc4eb8a"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"1a1f8564-e973-41ed-bd55-3911e95c06f8","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"5bc3d0e6e4c90831623f909e8135e6a93f30e70e9ae8b85f52efecfad84c4bcf"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.64:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-44ef67.apps.90cdb254-0673-4cb5-829b-399056712c87.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-13T22:05:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"df7704d4-4536-48c2-bc8d-dc745bca8cbd","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T22:05:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"df7704d4-4536-48c2-bc8d-dc745bca8cbd","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T22:05:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"df7704d4-4536-48c2-bc8d-dc745bca8cbd","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-44ef67/rate-test-model-44ef67\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-44ef67/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T22:05:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"df7704d4-4536-48c2-bc8d-dc745bca8cbd","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-13T22:05:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"df7704d4-4536-48c2-bc8d-dc745bca8cbd","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-13T22:05:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"df7704d4-4536-48c2-bc8d-dc745bca8cbd","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-13T22:05:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"df7704d4-4536-48c2-bc8d-dc745bca8cbd","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-13T22:05:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"df7704d4-4536-48c2-bc8d-dc745bca8cbd","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-13T22:05:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"209a114b-9fe6-4308-8095-cb8b480dc050","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:49422","PortSpecifier":{"PortValue":49422}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.66:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"209a114b-9fe6-4308-8095-cb8b480dc050","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-f0e328.apps.90cdb254-0673-4cb5-829b-399056712c87.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-13T22:05:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"209a114b-9fe6-4308-8095-cb8b480dc050","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:49422","PortSpecifier":{"PortValue":49422}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.66:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783980329,"nanos":728463859},"http":{"id":"209a114b-9fe6-4308-8095-cb8b480dc050","method":"POST","headers":{":authority":"e2e-shared-b-f0e328.apps.90cdb254-0673-4cb5-829b-399056712c87.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-13T22:05:29Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"209a114b-9fe6-4308-8095-cb8b480dc050","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-13T22:05:29Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"209a114b-9fe6-4308-8095-cb8b480dc050","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"1a1f8564-e973-41ed-bd55-3911e95c06f8","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=690d4199-87db-4410-9a8b-f9bbbfc4eb8a"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/399056712c87"]}}
{"level":"debug","ts":"2026-07-13T22:05:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"209a114b-9fe6-4308-8095-cb8b480dc050","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/399056712c87"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=690d4199-87db-4410-9a8b-f9bbbfc4eb8a"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"1a1f8564-e973-41ed-bd55-3911e95c06f8","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"2b42933b786984f30f6aea746c55ab3a825b967fe78da31a3bdc9ba0b2b2d2b6"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.66:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-f0e328.apps.90cdb254-0673-4cb5-829b-399056712c87.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-13T22:05:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"209a114b-9fe6-4308-8095-cb8b480dc050","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T22:05:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"209a114b-9fe6-4308-8095-cb8b480dc050","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T22:05:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"209a114b-9fe6-4308-8095-cb8b480dc050","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-f0e328/rate-test-model-f0e328\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-f0e328/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T22:05:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"209a114b-9fe6-4308-8095-cb8b480dc050","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-13T22:05:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"209a114b-9fe6-4308-8095-cb8b480dc050","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-13T22:05:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"209a114b-9fe6-4308-8095-cb8b480dc050","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-13T22:05:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"209a114b-9fe6-4308-8095-cb8b480dc050","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-13T22:05:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"209a114b-9fe6-4308-8095-cb8b480dc050","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-13T22:05:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"60911a24-83e0-4489-99d6-fa7b92560479","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:57952","PortSpecifier":{"PortValue":57952}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.64:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"60911a24-83e0-4489-99d6-fa7b92560479","method":"POST","path":"/ai-tenant-e2e-shared-a-44ef67/rate-test-model-44ef67/v1/completions","host":"e2e-shared-a-44ef67.apps.90cdb254-0673-4cb5-829b-399056712c87.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-13T22:05:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"60911a24-83e0-4489-99d6-fa7b92560479","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:57952","PortSpecifier":{"PortValue":57952}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.64:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783980329,"nanos":764169722},"http":{"id":"60911a24-83e0-4489-99d6-fa7b92560479","method":"POST","headers":{":authority":"e2e-shared-a-44ef67.apps.90cdb254-0673-4cb5-829b-399056712c87.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-44ef67/rate-test-model-44ef67/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-13T22:05:29Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"60911a24-83e0-4489-99d6-fa7b92560479","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-YijaJtWy17Hfexqo_J5Xo52AVmrh50M6rwqhzYFG4uG7XKmAM1LHnybDNFrV"}
{"level":"debug","ts":"2026-07-13T22:05:29Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"60911a24-83e0-4489-99d6-fa7b92560479","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-44ef67.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-YijaJtWy17Hfexqo_J5Xo52AVmrh50M6rwqhzYFG4uG7XKmAM1LHnybDNFrV\"}"}
{"level":"debug","ts":"2026-07-13T22:05:29Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"60911a24-83e0-4489-99d6-fa7b92560479","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-44ef67.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"7f29d90d-4a67-4c12-9888-4ed87a0f8f20","keyName":"e2e-rate-a-f140cc","subscription":"e2e-rate-iso-a-f140cc","tenant":"e2e-shared-a-44ef67","userId":"7f29d90d-4a67-4c12-9888-4ed87a0f8f20","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-13T22:05:29Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"60911a24-83e0-4489-99d6-fa7b92560479","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-44ef67.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-44ef67/rate-test-model-44ef67\",\"requestedSubscription\":\"e2e-rate-iso-a-f140cc\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-13T22:05:29Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"60911a24-83e0-4489-99d6-fa7b92560479","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-44ef67.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-44ef67","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-f140cc","namespace":"ai-tenant-e2e-shared-a-44ef67","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-13T22:05:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"60911a24-83e0-4489-99d6-fa7b92560479","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-13T22:05:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"60911a24-83e0-4489-99d6-fa7b92560479","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T22:05:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"60911a24-83e0-4489-99d6-fa7b92560479","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T22:05:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"60911a24-83e0-4489-99d6-fa7b92560479","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-44ef67/rate-test-model-44ef67\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-44ef67/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T22:05:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"60911a24-83e0-4489-99d6-fa7b92560479","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T22:05:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"60911a24-83e0-4489-99d6-fa7b92560479","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-13T22:05:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"60911a24-83e0-4489-99d6-fa7b92560479","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-f140cc"}
{"level":"debug","ts":"2026-07-13T22:05:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"60911a24-83e0-4489-99d6-fa7b92560479","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-13T22:05:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"60911a24-83e0-4489-99d6-fa7b92560479","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"7f29d90d-4a67-4c12-9888-4ed87a0f8f20","keyName":"e2e-rate-a-f140cc","selected_subscription":"e2e-rate-iso-a-f140cc","selected_subscription_key":"ai-tenant-e2e-shared-a-44ef67/e2e-rate-iso-a-f140cc@ai-tenant-e2e-shared-a-44ef67/rate-test-model-44ef67","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-44ef67","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-f140cc","namespace":"ai-tenant-e2e-shared-a-44ef67","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-13T22:05:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"60911a24-83e0-4489-99d6-fa7b92560479","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-13T22:05:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"60911a24-83e0-4489-99d6-fa7b92560479","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-13T22:05:30Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"55496915-9b31-4194-bf02-b4102ece9ae1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:57964","PortSpecifier":{"PortValue":57964}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.64:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"55496915-9b31-4194-bf02-b4102ece9ae1","method":"POST","path":"/ai-tenant-e2e-shared-a-44ef67/rate-test-model-44ef67/v1/completions","host":"e2e-shared-a-44ef67.apps.90cdb254-0673-4cb5-829b-399056712c87.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-13T22:05:30Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"55496915-9b31-4194-bf02-b4102ece9ae1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:57964","PortSpecifier":{"PortValue":57964}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.64:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783980330,"nanos":833519990},"http":{"id":"55496915-9b31-4194-bf02-b4102ece9ae1","method":"POST","headers":{":authority":"e2e-shared-a-44ef67.apps.90cdb254-0673-4cb5-829b-399056712c87.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-44ef67/rate-test-model-44ef67/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-13T22:05:30Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"55496915-9b31-4194-bf02-b4102ece9ae1","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-YijaJtWy17Hfexqo_J5Xo52AVmrh50M6rwqhzYFG4uG7XKmAM1LHnybDNFrV"}
{"level":"debug","ts":"2026-07-13T22:05:30Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"55496915-9b31-4194-bf02-b4102ece9ae1","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-44ef67.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-YijaJtWy17Hfexqo_J5Xo52AVmrh50M6rwqhzYFG4uG7XKmAM1LHnybDNFrV\"}"}
{"level":"debug","ts":"2026-07-13T22:05:30Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"55496915-9b31-4194-bf02-b4102ece9ae1","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-44ef67.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"7f29d90d-4a67-4c12-9888-4ed87a0f8f20","keyName":"e2e-rate-a-f140cc","subscription":"e2e-rate-iso-a-f140cc","tenant":"e2e-shared-a-44ef67","userId":"7f29d90d-4a67-4c12-9888-4ed87a0f8f20","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-13T22:05:30Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"55496915-9b31-4194-bf02-b4102ece9ae1","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-44ef67.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-44ef67/rate-test-model-44ef67\",\"requestedSubscription\":\"e2e-rate-iso-a-f140cc\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-13T22:05:30Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"55496915-9b31-4194-bf02-b4102ece9ae1","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-44ef67.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-44ef67","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-f140cc","namespace":"ai-tenant-e2e-shared-a-44ef67","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-13T22:05:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"55496915-9b31-4194-bf02-b4102ece9ae1","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-13T22:05:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"55496915-9b31-4194-bf02-b4102ece9ae1","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T22:05:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"55496915-9b31-4194-bf02-b4102ece9ae1","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T22:05:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"55496915-9b31-4194-bf02-b4102ece9ae1","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T22:05:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"55496915-9b31-4194-bf02-b4102ece9ae1","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-44ef67/rate-test-model-44ef67\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-44ef67/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T22:05:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"55496915-9b31-4194-bf02-b4102ece9ae1","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-13T22:05:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"55496915-9b31-4194-bf02-b4102ece9ae1","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-f140cc"}
{"level":"debug","ts":"2026-07-13T22:05:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"55496915-9b31-4194-bf02-b4102ece9ae1","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-13T22:05:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"55496915-9b31-4194-bf02-b4102ece9ae1","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"7f29d90d-4a67-4c12-9888-4ed87a0f8f20","keyName":"e2e-rate-a-f140cc","selected_subscription":"e2e-rate-iso-a-f140cc","selected_subscription_key":"ai-tenant-e2e-shared-a-44ef67/e2e-rate-iso-a-f140cc@ai-tenant-e2e-shared-a-44ef67/rate-test-model-44ef67","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-44ef67","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-f140cc","namespace":"ai-tenant-e2e-shared-a-44ef67","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-13T22:05:30Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"55496915-9b31-4194-bf02-b4102ece9ae1","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-13T22:05:30Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"55496915-9b31-4194-bf02-b4102ece9ae1","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-13T22:05:31Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a9433a27-1901-44bc-9593-44caa71b2186","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:57972","PortSpecifier":{"PortValue":57972}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.64:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"a9433a27-1901-44bc-9593-44caa71b2186","method":"POST","path":"/ai-tenant-e2e-shared-a-44ef67/rate-test-model-44ef67/v1/completions","host":"e2e-shared-a-44ef67.apps.90cdb254-0673-4cb5-829b-399056712c87.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-13T22:05:31Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a9433a27-1901-44bc-9593-44caa71b2186","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:57972","PortSpecifier":{"PortValue":57972}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.64:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783980331,"nanos":876411437},"http":{"id":"a9433a27-1901-44bc-9593-44caa71b2186","method":"POST","headers":{":authority":"e2e-shared-a-44ef67.apps.90cdb254-0673-4cb5-829b-399056712c87.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-44ef67/rate-test-model-44ef67/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-13T22:05:31Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"a9433a27-1901-44bc-9593-44caa71b2186","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-YijaJtWy17Hfexqo_J5Xo52AVmrh50M6rwqhzYFG4uG7XKmAM1LHnybDNFrV"}
{"level":"debug","ts":"2026-07-13T22:05:31Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a9433a27-1901-44bc-9593-44caa71b2186","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-44ef67.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-YijaJtWy17Hfexqo_J5Xo52AVmrh50M6rwqhzYFG4uG7XKmAM1LHnybDNFrV\"}"}
{"level":"debug","ts":"2026-07-13T22:05:31Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a9433a27-1901-44bc-9593-44caa71b2186","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-44ef67.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"7f29d90d-4a67-4c12-9888-4ed87a0f8f20","keyName":"e2e-rate-a-f140cc","subscription":"e2e-rate-iso-a-f140cc","tenant":"e2e-shared-a-44ef67","userId":"7f29d90d-4a67-4c12-9888-4ed87a0f8f20","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-13T22:05:31Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a9433a27-1901-44bc-9593-44caa71b2186","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-44ef67.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-44ef67/rate-test-model-44ef67\",\"requestedSubscription\":\"e2e-rate-iso-a-f140cc\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-13T22:05:31Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a9433a27-1901-44bc-9593-44caa71b2186","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-44ef67.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-44ef67","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-f140cc","namespace":"ai-tenant-e2e-shared-a-44ef67","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-13T22:05:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"a9433a27-1901-44bc-9593-44caa71b2186","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-13T22:05:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a9433a27-1901-44bc-9593-44caa71b2186","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T22:05:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a9433a27-1901-44bc-9593-44caa71b2186","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T22:05:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a9433a27-1901-44bc-9593-44caa71b2186","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-44ef67/rate-test-model-44ef67\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-44ef67/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T22:05:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a9433a27-1901-44bc-9593-44caa71b2186","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T22:05:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a9433a27-1901-44bc-9593-44caa71b2186","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-13T22:05:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a9433a27-1901-44bc-9593-44caa71b2186","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-f140cc"}
{"level":"debug","ts":"2026-07-13T22:05:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a9433a27-1901-44bc-9593-44caa71b2186","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-13T22:05:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a9433a27-1901-44bc-9593-44caa71b2186","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"7f29d90d-4a67-4c12-9888-4ed87a0f8f20","keyName":"e2e-rate-a-f140cc","selected_subscription":"e2e-rate-iso-a-f140cc","selected_subscription_key":"ai-tenant-e2e-shared-a-44ef67/e2e-rate-iso-a-f140cc@ai-tenant-e2e-shared-a-44ef67/rate-test-model-44ef67","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-44ef67","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-f140cc","namespace":"ai-tenant-e2e-shared-a-44ef67","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-13T22:05:31Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a9433a27-1901-44bc-9593-44caa71b2186","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-13T22:05:31Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a9433a27-1901-44bc-9593-44caa71b2186","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-13T22:05:32Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d3b70c58-3573-4cc9-afe0-9881e90033b7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:57984","PortSpecifier":{"PortValue":57984}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.64:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"d3b70c58-3573-4cc9-afe0-9881e90033b7","method":"POST","path":"/ai-tenant-e2e-shared-a-44ef67/rate-test-model-44ef67/v1/completions","host":"e2e-shared-a-44ef67.apps.90cdb254-0673-4cb5-829b-399056712c87.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-13T22:05:32Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d3b70c58-3573-4cc9-afe0-9881e90033b7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:57984","PortSpecifier":{"PortValue":57984}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.64:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783980332,"nanos":911939208},"http":{"id":"d3b70c58-3573-4cc9-afe0-9881e90033b7","method":"POST","headers":{":authority":"e2e-shared-a-44ef67.apps.90cdb254-0673-4cb5-829b-399056712c87.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-44ef67/rate-test-model-44ef67/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-13T22:05:32Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"d3b70c58-3573-4cc9-afe0-9881e90033b7","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-YijaJtWy17Hfexqo_J5Xo52AVmrh50M6rwqhzYFG4uG7XKmAM1LHnybDNFrV"}
{"level":"debug","ts":"2026-07-13T22:05:32Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"d3b70c58-3573-4cc9-afe0-9881e90033b7","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-44ef67.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-YijaJtWy17Hfexqo_J5Xo52AVmrh50M6rwqhzYFG4uG7XKmAM1LHnybDNFrV\"}"}
{"level":"debug","ts":"2026-07-13T22:05:32Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"d3b70c58-3573-4cc9-afe0-9881e90033b7","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-44ef67.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"7f29d90d-4a67-4c12-9888-4ed87a0f8f20","keyName":"e2e-rate-a-f140cc","subscription":"e2e-rate-iso-a-f140cc","tenant":"e2e-shared-a-44ef67","userId":"7f29d90d-4a67-4c12-9888-4ed87a0f8f20","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-13T22:05:32Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"d3b70c58-3573-4cc9-afe0-9881e90033b7","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-44ef67.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-44ef67/rate-test-model-44ef67\",\"requestedSubscription\":\"e2e-rate-iso-a-f140cc\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-13T22:05:32Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"d3b70c58-3573-4cc9-afe0-9881e90033b7","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-44ef67.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-44ef67","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-f140cc","namespace":"ai-tenant-e2e-shared-a-44ef67","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-13T22:05:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"d3b70c58-3573-4cc9-afe0-9881e90033b7","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-13T22:05:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d3b70c58-3573-4cc9-afe0-9881e90033b7","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T22:05:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d3b70c58-3573-4cc9-afe0-9881e90033b7","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T22:05:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d3b70c58-3573-4cc9-afe0-9881e90033b7","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T22:05:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d3b70c58-3573-4cc9-afe0-9881e90033b7","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-44ef67/rate-test-model-44ef67\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-44ef67/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T22:05:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d3b70c58-3573-4cc9-afe0-9881e90033b7","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-13T22:05:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d3b70c58-3573-4cc9-afe0-9881e90033b7","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-13T22:05:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d3b70c58-3573-4cc9-afe0-9881e90033b7","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-f140cc"}
{"level":"debug","ts":"2026-07-13T22:05:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d3b70c58-3573-4cc9-afe0-9881e90033b7","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"7f29d90d-4a67-4c12-9888-4ed87a0f8f20","keyName":"e2e-rate-a-f140cc","selected_subscription":"e2e-rate-iso-a-f140cc","selected_subscription_key":"ai-tenant-e2e-shared-a-44ef67/e2e-rate-iso-a-f140cc@ai-tenant-e2e-shared-a-44ef67/rate-test-model-44ef67","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-44ef67","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-f140cc","namespace":"ai-tenant-e2e-shared-a-44ef67","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-13T22:05:32Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d3b70c58-3573-4cc9-afe0-9881e90033b7","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-13T22:05:32Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d3b70c58-3573-4cc9-afe0-9881e90033b7","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-13T22:05:33Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2b98d09c-fb5c-4455-b7e6-7dba690dd26c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:60318","PortSpecifier":{"PortValue":60318}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.64:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"2b98d09c-fb5c-4455-b7e6-7dba690dd26c","method":"POST","path":"/ai-tenant-e2e-shared-a-44ef67/rate-test-model-44ef67/v1/completions","host":"e2e-shared-a-44ef67.apps.90cdb254-0673-4cb5-829b-399056712c87.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-13T22:05:33Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2b98d09c-fb5c-4455-b7e6-7dba690dd26c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:60318","PortSpecifier":{"PortValue":60318}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.64:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783980333,"nanos":945616914},"http":{"id":"2b98d09c-fb5c-4455-b7e6-7dba690dd26c","method":"POST","headers":{":authority":"e2e-shared-a-44ef67.apps.90cdb254-0673-4cb5-829b-399056712c87.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-44ef67/rate-test-model-44ef67/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-13T22:05:33Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"2b98d09c-fb5c-4455-b7e6-7dba690dd26c","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-YijaJtWy17Hfexqo_J5Xo52AVmrh50M6rwqhzYFG4uG7XKmAM1LHnybDNFrV"}
{"level":"debug","ts":"2026-07-13T22:05:33Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"2b98d09c-fb5c-4455-b7e6-7dba690dd26c","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-44ef67.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-YijaJtWy17Hfexqo_J5Xo52AVmrh50M6rwqhzYFG4uG7XKmAM1LHnybDNFrV\"}"}
{"level":"debug","ts":"2026-07-13T22:05:33Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"2b98d09c-fb5c-4455-b7e6-7dba690dd26c","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-44ef67.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"7f29d90d-4a67-4c12-9888-4ed87a0f8f20","keyName":"e2e-rate-a-f140cc","subscription":"e2e-rate-iso-a-f140cc","tenant":"e2e-shared-a-44ef67","userId":"7f29d90d-4a67-4c12-9888-4ed87a0f8f20","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-13T22:05:33Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"2b98d09c-fb5c-4455-b7e6-7dba690dd26c","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-44ef67.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-44ef67/rate-test-model-44ef67\",\"requestedSubscription\":\"e2e-rate-iso-a-f140cc\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-13T22:05:33Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"2b98d09c-fb5c-4455-b7e6-7dba690dd26c","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-44ef67.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-44ef67","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-f140cc","namespace":"ai-tenant-e2e-shared-a-44ef67","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-13T22:05:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"2b98d09c-fb5c-4455-b7e6-7dba690dd26c","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-13T22:05:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2b98d09c-fb5c-4455-b7e6-7dba690dd26c","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T22:05:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2b98d09c-fb5c-4455-b7e6-7dba690dd26c","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T22:05:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2b98d09c-fb5c-4455-b7e6-7dba690dd26c","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-44ef67/rate-test-model-44ef67\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-44ef67/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T22:05:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2b98d09c-fb5c-4455-b7e6-7dba690dd26c","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T22:05:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2b98d09c-fb5c-4455-b7e6-7dba690dd26c","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-13T22:05:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2b98d09c-fb5c-4455-b7e6-7dba690dd26c","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-13T22:05:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2b98d09c-fb5c-4455-b7e6-7dba690dd26c","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-f140cc"}
{"level":"debug","ts":"2026-07-13T22:05:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2b98d09c-fb5c-4455-b7e6-7dba690dd26c","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"7f29d90d-4a67-4c12-9888-4ed87a0f8f20","keyName":"e2e-rate-a-f140cc","selected_subscription":"e2e-rate-iso-a-f140cc","selected_subscription_key":"ai-tenant-e2e-shared-a-44ef67/e2e-rate-iso-a-f140cc@ai-tenant-e2e-shared-a-44ef67/rate-test-model-44ef67","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-44ef67","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-f140cc","namespace":"ai-tenant-e2e-shared-a-44ef67","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-13T22:05:33Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2b98d09c-fb5c-4455-b7e6-7dba690dd26c","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-13T22:05:33Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2b98d09c-fb5c-4455-b7e6-7dba690dd26c","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-13T22:05:34Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"98dc9dd9-3597-490e-be11-6e5c009f44c1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:60328","PortSpecifier":{"PortValue":60328}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.64:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"98dc9dd9-3597-490e-be11-6e5c009f44c1","method":"POST","path":"/ai-tenant-e2e-shared-a-44ef67/rate-test-model-44ef67/v1/completions","host":"e2e-shared-a-44ef67.apps.90cdb254-0673-4cb5-829b-399056712c87.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-13T22:05:34Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"98dc9dd9-3597-490e-be11-6e5c009f44c1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:60328","PortSpecifier":{"PortValue":60328}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.64:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783980334,"nanos":982809519},"http":{"id":"98dc9dd9-3597-490e-be11-6e5c009f44c1","method":"POST","headers":{":authority":"e2e-shared-a-44ef67.apps.90cdb254-0673-4cb5-829b-399056712c87.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-44ef67/rate-test-model-44ef67/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-13T22:05:34Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"98dc9dd9-3597-490e-be11-6e5c009f44c1","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-YijaJtWy17Hfexqo_J5Xo52AVmrh50M6rwqhzYFG4uG7XKmAM1LHnybDNFrV"}
{"level":"debug","ts":"2026-07-13T22:05:34Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"98dc9dd9-3597-490e-be11-6e5c009f44c1","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-44ef67.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-YijaJtWy17Hfexqo_J5Xo52AVmrh50M6rwqhzYFG4uG7XKmAM1LHnybDNFrV\"}"}
{"level":"debug","ts":"2026-07-13T22:05:34Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"98dc9dd9-3597-490e-be11-6e5c009f44c1","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-44ef67.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"7f29d90d-4a67-4c12-9888-4ed87a0f8f20","keyName":"e2e-rate-a-f140cc","subscription":"e2e-rate-iso-a-f140cc","tenant":"e2e-shared-a-44ef67","userId":"7f29d90d-4a67-4c12-9888-4ed87a0f8f20","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-13T22:05:34Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"98dc9dd9-3597-490e-be11-6e5c009f44c1","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-44ef67.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-44ef67/rate-test-model-44ef67\",\"requestedSubscription\":\"e2e-rate-iso-a-f140cc\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-13T22:05:34Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"98dc9dd9-3597-490e-be11-6e5c009f44c1","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-44ef67.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-44ef67","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-f140cc","namespace":"ai-tenant-e2e-shared-a-44ef67","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-13T22:05:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"98dc9dd9-3597-490e-be11-6e5c009f44c1","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-13T22:05:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"98dc9dd9-3597-490e-be11-6e5c009f44c1","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T22:05:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"98dc9dd9-3597-490e-be11-6e5c009f44c1","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T22:05:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"98dc9dd9-3597-490e-be11-6e5c009f44c1","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-44ef67/rate-test-model-44ef67\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-44ef67/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T22:05:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"98dc9dd9-3597-490e-be11-6e5c009f44c1","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T22:05:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"98dc9dd9-3597-490e-be11-6e5c009f44c1","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-13T22:05:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"98dc9dd9-3597-490e-be11-6e5c009f44c1","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-13T22:05:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"98dc9dd9-3597-490e-be11-6e5c009f44c1","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-f140cc"}
{"level":"debug","ts":"2026-07-13T22:05:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"98dc9dd9-3597-490e-be11-6e5c009f44c1","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"7f29d90d-4a67-4c12-9888-4ed87a0f8f20","keyName":"e2e-rate-a-f140cc","selected_subscription":"e2e-rate-iso-a-f140cc","selected_subscription_key":"ai-tenant-e2e-shared-a-44ef67/e2e-rate-iso-a-f140cc@ai-tenant-e2e-shared-a-44ef67/rate-test-model-44ef67","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-44ef67","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-f140cc","namespace":"ai-tenant-e2e-shared-a-44ef67","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-13T22:05:34Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"98dc9dd9-3597-490e-be11-6e5c009f44c1","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-13T22:05:34Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"98dc9dd9-3597-490e-be11-6e5c009f44c1","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-13T22:05:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e3e08525-8a55-4dbb-b93b-253575af0fab","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:60332","PortSpecifier":{"PortValue":60332}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.64:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"e3e08525-8a55-4dbb-b93b-253575af0fab","method":"POST","path":"/ai-tenant-e2e-shared-a-44ef67/rate-test-model-44ef67/v1/completions","host":"e2e-shared-a-44ef67.apps.90cdb254-0673-4cb5-829b-399056712c87.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-13T22:05:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e3e08525-8a55-4dbb-b93b-253575af0fab","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:60332","PortSpecifier":{"PortValue":60332}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.64:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783980336,"nanos":18713308},"http":{"id":"e3e08525-8a55-4dbb-b93b-253575af0fab","method":"POST","headers":{":authority":"e2e-shared-a-44ef67.apps.90cdb254-0673-4cb5-829b-399056712c87.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-44ef67/rate-test-model-44ef67/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-13T22:05:36Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"e3e08525-8a55-4dbb-b93b-253575af0fab","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-YijaJtWy17Hfexqo_J5Xo52AVmrh50M6rwqhzYFG4uG7XKmAM1LHnybDNFrV"}
{"level":"debug","ts":"2026-07-13T22:05:36Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"e3e08525-8a55-4dbb-b93b-253575af0fab","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-44ef67.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-YijaJtWy17Hfexqo_J5Xo52AVmrh50M6rwqhzYFG4uG7XKmAM1LHnybDNFrV\"}"}
{"level":"debug","ts":"2026-07-13T22:05:36Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"e3e08525-8a55-4dbb-b93b-253575af0fab","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-44ef67.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"7f29d90d-4a67-4c12-9888-4ed87a0f8f20","keyName":"e2e-rate-a-f140cc","subscription":"e2e-rate-iso-a-f140cc","tenant":"e2e-shared-a-44ef67","userId":"7f29d90d-4a67-4c12-9888-4ed87a0f8f20","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-13T22:05:36Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"e3e08525-8a55-4dbb-b93b-253575af0fab","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-44ef67.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-44ef67/rate-test-model-44ef67\",\"requestedSubscription\":\"e2e-rate-iso-a-f140cc\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-13T22:05:36Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"e3e08525-8a55-4dbb-b93b-253575af0fab","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-44ef67.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-44ef67","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-f140cc","namespace":"ai-tenant-e2e-shared-a-44ef67","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-13T22:05:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"e3e08525-8a55-4dbb-b93b-253575af0fab","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-13T22:05:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e3e08525-8a55-4dbb-b93b-253575af0fab","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T22:05:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e3e08525-8a55-4dbb-b93b-253575af0fab","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T22:05:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e3e08525-8a55-4dbb-b93b-253575af0fab","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T22:05:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e3e08525-8a55-4dbb-b93b-253575af0fab","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-44ef67/rate-test-model-44ef67\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-44ef67/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T22:05:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e3e08525-8a55-4dbb-b93b-253575af0fab","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-13T22:05:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e3e08525-8a55-4dbb-b93b-253575af0fab","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-13T22:05:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e3e08525-8a55-4dbb-b93b-253575af0fab","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-f140cc"}
{"level":"debug","ts":"2026-07-13T22:05:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e3e08525-8a55-4dbb-b93b-253575af0fab","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"7f29d90d-4a67-4c12-9888-4ed87a0f8f20","keyName":"e2e-rate-a-f140cc","selected_subscription":"e2e-rate-iso-a-f140cc","selected_subscription_key":"ai-tenant-e2e-shared-a-44ef67/e2e-rate-iso-a-f140cc@ai-tenant-e2e-shared-a-44ef67/rate-test-model-44ef67","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-44ef67","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-f140cc","namespace":"ai-tenant-e2e-shared-a-44ef67","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-13T22:05:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e3e08525-8a55-4dbb-b93b-253575af0fab","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-13T22:05:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e3e08525-8a55-4dbb-b93b-253575af0fab","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-13T22:05:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"32628dde-a85b-4999-a2e5-7233a4f482e9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:60336","PortSpecifier":{"PortValue":60336}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.64:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"32628dde-a85b-4999-a2e5-7233a4f482e9","method":"POST","path":"/ai-tenant-e2e-shared-a-44ef67/rate-test-model-44ef67/v1/completions","host":"e2e-shared-a-44ef67.apps.90cdb254-0673-4cb5-829b-399056712c87.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-13T22:05:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"32628dde-a85b-4999-a2e5-7233a4f482e9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:60336","PortSpecifier":{"PortValue":60336}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.64:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783980337,"nanos":54897065},"http":{"id":"32628dde-a85b-4999-a2e5-7233a4f482e9","method":"POST","headers":{":authority":"e2e-shared-a-44ef67.apps.90cdb254-0673-4cb5-829b-399056712c87.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-44ef67/rate-test-model-44ef67/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-13T22:05:37Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"32628dde-a85b-4999-a2e5-7233a4f482e9","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-YijaJtWy17Hfexqo_J5Xo52AVmrh50M6rwqhzYFG4uG7XKmAM1LHnybDNFrV"}
{"level":"debug","ts":"2026-07-13T22:05:37Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"32628dde-a85b-4999-a2e5-7233a4f482e9","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-44ef67.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-YijaJtWy17Hfexqo_J5Xo52AVmrh50M6rwqhzYFG4uG7XKmAM1LHnybDNFrV\"}"}
{"level":"debug","ts":"2026-07-13T22:05:37Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"32628dde-a85b-4999-a2e5-7233a4f482e9","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-44ef67.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"7f29d90d-4a67-4c12-9888-4ed87a0f8f20","keyName":"e2e-rate-a-f140cc","subscription":"e2e-rate-iso-a-f140cc","tenant":"e2e-shared-a-44ef67","userId":"7f29d90d-4a67-4c12-9888-4ed87a0f8f20","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-13T22:05:37Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"32628dde-a85b-4999-a2e5-7233a4f482e9","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-44ef67.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-44ef67/rate-test-model-44ef67\",\"requestedSubscription\":\"e2e-rate-iso-a-f140cc\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-13T22:05:37Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"32628dde-a85b-4999-a2e5-7233a4f482e9","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-44ef67.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-44ef67","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-f140cc","namespace":"ai-tenant-e2e-shared-a-44ef67","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-13T22:05:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"32628dde-a85b-4999-a2e5-7233a4f482e9","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-13T22:05:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"32628dde-a85b-4999-a2e5-7233a4f482e9","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T22:05:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"32628dde-a85b-4999-a2e5-7233a4f482e9","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T22:05:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"32628dde-a85b-4999-a2e5-7233a4f482e9","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-44ef67/rate-test-model-44ef67\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-44ef67/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T22:05:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"32628dde-a85b-4999-a2e5-7233a4f482e9","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T22:05:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"32628dde-a85b-4999-a2e5-7233a4f482e9","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-13T22:05:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"32628dde-a85b-4999-a2e5-7233a4f482e9","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-f140cc"}
{"level":"debug","ts":"2026-07-13T22:05:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"32628dde-a85b-4999-a2e5-7233a4f482e9","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-13T22:05:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"32628dde-a85b-4999-a2e5-7233a4f482e9","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"7f29d90d-4a67-4c12-9888-4ed87a0f8f20","keyName":"e2e-rate-a-f140cc","selected_subscription":"e2e-rate-iso-a-f140cc","selected_subscription_key":"ai-tenant-e2e-shared-a-44ef67/e2e-rate-iso-a-f140cc@ai-tenant-e2e-shared-a-44ef67/rate-test-model-44ef67","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-44ef67","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-f140cc","namespace":"ai-tenant-e2e-shared-a-44ef67","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-13T22:05:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"32628dde-a85b-4999-a2e5-7233a4f482e9","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-13T22:05:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"32628dde-a85b-4999-a2e5-7233a4f482e9","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-13T22:05:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"42ef3e26-362a-438f-87d6-721a6689cd91","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:60342","PortSpecifier":{"PortValue":60342}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.64:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"42ef3e26-362a-438f-87d6-721a6689cd91","method":"POST","path":"/ai-tenant-e2e-shared-a-44ef67/rate-test-model-44ef67/v1/completions","host":"e2e-shared-a-44ef67.apps.90cdb254-0673-4cb5-829b-399056712c87.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-13T22:05:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"42ef3e26-362a-438f-87d6-721a6689cd91","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:60342","PortSpecifier":{"PortValue":60342}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.64:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783980338,"nanos":90978607},"http":{"id":"42ef3e26-362a-438f-87d6-721a6689cd91","method":"POST","headers":{":authority":"e2e-shared-a-44ef67.apps.90cdb254-0673-4cb5-829b-399056712c87.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-44ef67/rate-test-model-44ef67/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-13T22:05:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"42ef3e26-362a-438f-87d6-721a6689cd91","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-YijaJtWy17Hfexqo_J5Xo52AVmrh50M6rwqhzYFG4uG7XKmAM1LHnybDNFrV"}
{"level":"debug","ts":"2026-07-13T22:05:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"42ef3e26-362a-438f-87d6-721a6689cd91","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-44ef67.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-YijaJtWy17Hfexqo_J5Xo52AVmrh50M6rwqhzYFG4uG7XKmAM1LHnybDNFrV\"}"}
{"level":"debug","ts":"2026-07-13T22:05:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"42ef3e26-362a-438f-87d6-721a6689cd91","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-44ef67.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"7f29d90d-4a67-4c12-9888-4ed87a0f8f20","keyName":"e2e-rate-a-f140cc","subscription":"e2e-rate-iso-a-f140cc","tenant":"e2e-shared-a-44ef67","userId":"7f29d90d-4a67-4c12-9888-4ed87a0f8f20","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-13T22:05:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"42ef3e26-362a-438f-87d6-721a6689cd91","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-44ef67.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-44ef67/rate-test-model-44ef67\",\"requestedSubscription\":\"e2e-rate-iso-a-f140cc\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-13T22:05:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"42ef3e26-362a-438f-87d6-721a6689cd91","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-44ef67.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-44ef67","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-f140cc","namespace":"ai-tenant-e2e-shared-a-44ef67","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-13T22:05:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"42ef3e26-362a-438f-87d6-721a6689cd91","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-13T22:05:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"42ef3e26-362a-438f-87d6-721a6689cd91","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T22:05:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"42ef3e26-362a-438f-87d6-721a6689cd91","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T22:05:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"42ef3e26-362a-438f-87d6-721a6689cd91","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-44ef67/rate-test-model-44ef67\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-44ef67/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T22:05:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"42ef3e26-362a-438f-87d6-721a6689cd91","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T22:05:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"42ef3e26-362a-438f-87d6-721a6689cd91","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-13T22:05:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"42ef3e26-362a-438f-87d6-721a6689cd91","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-13T22:05:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"42ef3e26-362a-438f-87d6-721a6689cd91","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-f140cc"}
{"level":"debug","ts":"2026-07-13T22:05:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"42ef3e26-362a-438f-87d6-721a6689cd91","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"7f29d90d-4a67-4c12-9888-4ed87a0f8f20","keyName":"e2e-rate-a-f140cc","selected_subscription":"e2e-rate-iso-a-f140cc","selected_subscription_key":"ai-tenant-e2e-shared-a-44ef67/e2e-rate-iso-a-f140cc@ai-tenant-e2e-shared-a-44ef67/rate-test-model-44ef67","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-44ef67","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-f140cc","namespace":"ai-tenant-e2e-shared-a-44ef67","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-13T22:05:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"42ef3e26-362a-438f-87d6-721a6689cd91","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-13T22:05:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"42ef3e26-362a-438f-87d6-721a6689cd91","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-13T22:05:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c3c1262a-9dcf-411e-ab87-771a8b028af3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:60356","PortSpecifier":{"PortValue":60356}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.64:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"c3c1262a-9dcf-411e-ab87-771a8b028af3","method":"POST","path":"/ai-tenant-e2e-shared-a-44ef67/rate-test-model-44ef67/v1/completions","host":"e2e-shared-a-44ef67.apps.90cdb254-0673-4cb5-829b-399056712c87.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-13T22:05:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c3c1262a-9dcf-411e-ab87-771a8b028af3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:60356","PortSpecifier":{"PortValue":60356}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.64:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783980339,"nanos":128517006},"http":{"id":"c3c1262a-9dcf-411e-ab87-771a8b028af3","method":"POST","headers":{":authority":"e2e-shared-a-44ef67.apps.90cdb254-0673-4cb5-829b-399056712c87.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-44ef67/rate-test-model-44ef67/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-13T22:05:39Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"c3c1262a-9dcf-411e-ab87-771a8b028af3","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-YijaJtWy17Hfexqo_J5Xo52AVmrh50M6rwqhzYFG4uG7XKmAM1LHnybDNFrV"}
{"level":"debug","ts":"2026-07-13T22:05:39Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"c3c1262a-9dcf-411e-ab87-771a8b028af3","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-44ef67.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-YijaJtWy17Hfexqo_J5Xo52AVmrh50M6rwqhzYFG4uG7XKmAM1LHnybDNFrV\"}"}
{"level":"debug","ts":"2026-07-13T22:05:39Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"c3c1262a-9dcf-411e-ab87-771a8b028af3","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-44ef67.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"7f29d90d-4a67-4c12-9888-4ed87a0f8f20","keyName":"e2e-rate-a-f140cc","subscription":"e2e-rate-iso-a-f140cc","tenant":"e2e-shared-a-44ef67","userId":"7f29d90d-4a67-4c12-9888-4ed87a0f8f20","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-13T22:05:39Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"c3c1262a-9dcf-411e-ab87-771a8b028af3","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-44ef67.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-44ef67/rate-test-model-44ef67\",\"requestedSubscription\":\"e2e-rate-iso-a-f140cc\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-13T22:05:39Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"c3c1262a-9dcf-411e-ab87-771a8b028af3","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-44ef67.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-44ef67","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-f140cc","namespace":"ai-tenant-e2e-shared-a-44ef67","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-13T22:05:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"c3c1262a-9dcf-411e-ab87-771a8b028af3","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-13T22:05:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c3c1262a-9dcf-411e-ab87-771a8b028af3","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T22:05:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c3c1262a-9dcf-411e-ab87-771a8b028af3","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T22:05:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c3c1262a-9dcf-411e-ab87-771a8b028af3","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-44ef67/rate-test-model-44ef67\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-44ef67/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T22:05:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c3c1262a-9dcf-411e-ab87-771a8b028af3","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T22:05:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c3c1262a-9dcf-411e-ab87-771a8b028af3","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-13T22:05:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c3c1262a-9dcf-411e-ab87-771a8b028af3","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-13T22:05:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c3c1262a-9dcf-411e-ab87-771a8b028af3","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-f140cc"}
{"level":"debug","ts":"2026-07-13T22:05:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c3c1262a-9dcf-411e-ab87-771a8b028af3","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"7f29d90d-4a67-4c12-9888-4ed87a0f8f20","keyName":"e2e-rate-a-f140cc","selected_subscription":"e2e-rate-iso-a-f140cc","selected_subscription_key":"ai-tenant-e2e-shared-a-44ef67/e2e-rate-iso-a-f140cc@ai-tenant-e2e-shared-a-44ef67/rate-test-model-44ef67","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-44ef67","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-f140cc","namespace":"ai-tenant-e2e-shared-a-44ef67","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-13T22:05:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c3c1262a-9dcf-411e-ab87-771a8b028af3","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-13T22:05:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c3c1262a-9dcf-411e-ab87-771a8b028af3","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-13T22:05:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b0f5e58e-d434-4a0a-8f6b-16d88edf09b9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:49702","PortSpecifier":{"PortValue":49702}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.66:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"b0f5e58e-d434-4a0a-8f6b-16d88edf09b9","method":"POST","path":"/ai-tenant-e2e-shared-b-f0e328/rate-test-model-f0e328/v1/completions","host":"e2e-shared-b-f0e328.apps.90cdb254-0673-4cb5-829b-399056712c87.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-13T22:05:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b0f5e58e-d434-4a0a-8f6b-16d88edf09b9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.13:49702","PortSpecifier":{"PortValue":49702}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.66:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783980339,"nanos":163895522},"http":{"id":"b0f5e58e-d434-4a0a-8f6b-16d88edf09b9","method":"POST","headers":{":authority":"e2e-shared-b-f0e328.apps.90cdb254-0673-4cb5-829b-399056712c87.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-b-f0e328/rate-test-model-f0e328/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-13T22:05:39Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"b0f5e58e-d434-4a0a-8f6b-16d88edf09b9","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-17DnqDGeumbHwsWOy_8e902M7ejUWgI6dhuNnLUxDZzLf70dbmS9erUREb8Uo"}
{"level":"debug","ts":"2026-07-13T22:05:39Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"b0f5e58e-d434-4a0a-8f6b-16d88edf09b9","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-b-f0e328.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-17DnqDGeumbHwsWOy_8e902M7ejUWgI6dhuNnLUxDZzLf70dbmS9erUREb8Uo\"}"}
{"level":"debug","ts":"2026-07-13T22:05:39Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"b0f5e58e-d434-4a0a-8f6b-16d88edf09b9","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-f0e328.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"d2e555ea-4ddc-4a5b-aa01-9f42f221f30c","keyName":"e2e-rate-b-f140cc","subscription":"e2e-rate-iso-b-f140cc","tenant":"e2e-shared-b-f0e328","userId":"d2e555ea-4ddc-4a5b-aa01-9f42f221f30c","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-13T22:05:39Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"b0f5e58e-d434-4a0a-8f6b-16d88edf09b9","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-b-f0e328.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-b-f0e328/rate-test-model-f0e328\",\"requestedSubscription\":\"e2e-rate-iso-b-f140cc\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-13T22:05:39Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"b0f5e58e-d434-4a0a-8f6b-16d88edf09b9","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-f0e328.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-f0e328","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-f140cc","namespace":"ai-tenant-e2e-shared-b-f0e328","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-13T22:05:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"b0f5e58e-d434-4a0a-8f6b-16d88edf09b9","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-13T22:05:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b0f5e58e-d434-4a0a-8f6b-16d88edf09b9","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T22:05:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b0f5e58e-d434-4a0a-8f6b-16d88edf09b9","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T22:05:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b0f5e58e-d434-4a0a-8f6b-16d88edf09b9","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-f0e328/rate-test-model-f0e328\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-f0e328/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T22:05:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b0f5e58e-d434-4a0a-8f6b-16d88edf09b9","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-13T22:05:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b0f5e58e-d434-4a0a-8f6b-16d88edf09b9","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-13T22:05:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b0f5e58e-d434-4a0a-8f6b-16d88edf09b9","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-b-f140cc"}
{"level":"debug","ts":"2026-07-13T22:05:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b0f5e58e-d434-4a0a-8f6b-16d88edf09b9","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-13T22:05:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b0f5e58e-d434-4a0a-8f6b-16d88edf09b9","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"d2e555ea-4ddc-4a5b-aa01-9f42f221f30c","keyName":"e2e-rate-b-f140cc","selected_subscription":"e2e-rate-iso-b-f140cc","selected_subscription_key":"ai-tenant-e2e-shared-b-f0e328/e2e-rate-iso-b-f140cc@ai-tenant-e2e-shared-b-f0e328/rate-test-model-f0e328","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-f0e328","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-f140cc","namespace":"ai-tenant-e2e-shared-b-f0e328","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-13T22:05:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b0f5e58e-d434-4a0a-8f6b-16d88edf09b9","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-13T22:05:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b0f5e58e-d434-4a0a-8f6b-16d88edf09b9","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-13T22:05:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/818ab780d2764176ece19c9ecf1f4e7b40b318323c07cf46c491e45cd6b2e7cf"}
{"level":"info","ts":"2026-07-13T22:05:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/eaca0db86e69c9967785c4cc0b9ab92cd6fcdc7a3ed0f57ff9027604ee70437c"}
{"level":"info","ts":"2026-07-13T22:05:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/e0d6e586ea4885531713721da0edd9b3c134f549f35b5f170e0ccfb9c58d39a7"}
{"level":"info","ts":"2026-07-13T22:05:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/0230fb385edd493d79e05ed9c0cd0e63570c9dd1784f0711f305a3aa3d199cf2"}
{"level":"info","ts":"2026-07-13T22:05:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/26f514ea7a80feb2a7a24b3d13358b5314a7ff974fd39b30f4144e13ce15e32d"}
{"level":"info","ts":"2026-07-13T22:05:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/9cf5673fe4fc5526bac69b374c3a0a3a238796dda7cd3ac3e96e26677eb6bf72"}
{"level":"info","ts":"2026-07-13T22:05:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/fa42c5bb70564658d8402436395fca7bad93e1b4dd7963f558af7a635f11762c"}
{"level":"info","ts":"2026-07-13T22:05:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/ed6a46de873ae8893b3b021c2e814928055ceed50524a161241b223fa68e3177"}
{"level":"info","ts":"2026-07-13T22:05:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/d504298d6fb8dfda9dc21a6bc9bfdb9755d81cd5b9a467d2fa0bf9204ef7fc36"}
{"level":"info","ts":"2026-07-13T22:05:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/a111fc3e0459c1e24b0be2150a28d7278948be5db3a78f4ffd9838322e0b865e"}
{"level":"info","ts":"2026-07-13T22:05:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/9921a4c4e184cb4ffac68872cc995101abafde232a72376d09e2704c1cb8f99f"}
{"level":"info","ts":"2026-07-13T22:05:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/f0c7d4c9512c4f722b661d3b38e1940f7cf7a560b37c02f44db744282622baca"}
{"level":"info","ts":"2026-07-13T22:05:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/04055b703f60a314c8f7af342b6f1e128948f097215a0711463b43bcb5fb747a"}
{"level":"info","ts":"2026-07-13T22:05:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/1e3bc616bd25180dab289dfe783b0af541d34299d1ea0b2a4f0bcad14cf68615"}
{"level":"info","ts":"2026-07-13T22:05:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/34ed45eff00a4c79d2ecaec0ec5430a7675699ac55c01f2c39ac67aa17a42a82"}
{"level":"info","ts":"2026-07-13T22:05:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/29cd70821b77bbedb334f60a15f77a0d8fcd1f81d3affd7f45cfe64115cbda76"}
{"level":"info","ts":"2026-07-13T22:06:13Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/5bc3d0e6e4c90831623f909e8135e6a93f30e70e9ae8b85f52efecfad84c4bcf"}
{"level":"info","ts":"2026-07-13T22:06:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/5f66e0467e508d4810641b779ccd0fd373a79eade0600c330831cf09869023b7"}
{"level":"info","ts":"2026-07-13T22:06:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/f59f9659af28bf41d9f2caebef09ed29f1091dc1e22376ac3cf25896f1144ec8"}
{"level":"info","ts":"2026-07-13T22:06:14Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/0d186e759965f9293385c5eb1fe6850f50cc021f99cf5da64ce565bb553c3e39"}
{"level":"info","ts":"2026-07-13T22:06:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/e530e68565d7c3478114a12b60d84aab3e363eda127255ff3d157697d2142a14"}
{"level":"info","ts":"2026-07-13T22:06:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/bc81350bd84dc07a39b4c9cd86fdcebfd5d5680689d2911bdead7cf109ac0cce"}
{"level":"info","ts":"2026-07-13T22:06:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/16f161b9726293de06d5feccc12eb5b1bb8b6cd2d8428c33e42c8cdf9d20ec73"}
{"level":"info","ts":"2026-07-13T22:06:40Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/2b42933b786984f30f6aea746c55ab3a825b967fe78da31a3bdc9ba0b2b2d2b6"}