{"level":"info","ts":"2026-07-02T19:55:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9d17cc73f0a37e8116def3b6a5a1c5072c2f0ee6575d0f90891c708d29be8ddd"}
{"level":"debug","ts":"2026-07-02T19:55:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9d17cc73f0a37e8116def3b6a5a1c5072c2f0ee6575d0f90891c708d29be8ddd","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T19:55:17Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T19:55:17Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["9d17cc73f0a37e8116def3b6a5a1c5072c2f0ee6575d0f90891c708d29be8ddd"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T19:55:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9d17cc73f0a37e8116def3b6a5a1c5072c2f0ee6575d0f90891c708d29be8ddd","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T19:55:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9d17cc73f0a37e8116def3b6a5a1c5072c2f0ee6575d0f90891c708d29be8ddd","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T19:55:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9d17cc73f0a37e8116def3b6a5a1c5072c2f0ee6575d0f90891c708d29be8ddd","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T19:55:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/850534fa0cdbb991bfb075008d3225736952c988937168c31d24c62f51ce43b3"}
{"level":"info","ts":"2026-07-02T19:55:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9d17cc73f0a37e8116def3b6a5a1c5072c2f0ee6575d0f90891c708d29be8ddd"}
{"level":"debug","ts":"2026-07-02T19:55:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5bee434e3fb4c810be941e79afd04e7dbaee2f5195449cc7c0c0c358c2e68ea1","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T19:55:17Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T19:55:17Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T19:55:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5bee434e3fb4c810be941e79afd04e7dbaee2f5195449cc7c0c0c358c2e68ea1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T19:55:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5bee434e3fb4c810be941e79afd04e7dbaee2f5195449cc7c0c0c358c2e68ea1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T19:55:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5bee434e3fb4c810be941e79afd04e7dbaee2f5195449cc7c0c0c358c2e68ea1","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T19:55:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5bee434e3fb4c810be941e79afd04e7dbaee2f5195449cc7c0c0c358c2e68ea1"}
{"level":"debug","ts":"2026-07-02T19:55:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5bee434e3fb4c810be941e79afd04e7dbaee2f5195449cc7c0c0c358c2e68ea1","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T19:55:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5bee434e3fb4c810be941e79afd04e7dbaee2f5195449cc7c0c0c358c2e68ea1"}
{"level":"debug","ts":"2026-07-02T19:55:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5bee434e3fb4c810be941e79afd04e7dbaee2f5195449cc7c0c0c358c2e68ea1","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T19:55:17Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T19:55:17Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["5bee434e3fb4c810be941e79afd04e7dbaee2f5195449cc7c0c0c358c2e68ea1"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T19:55:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5bee434e3fb4c810be941e79afd04e7dbaee2f5195449cc7c0c0c358c2e68ea1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T19:55:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"61e3a6c3539ef45ffa4da6485c1bb6565794d8972e2f338e524c03c0bb536933","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T19:55:17Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T19:55:17Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T19:55:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"61e3a6c3539ef45ffa4da6485c1bb6565794d8972e2f338e524c03c0bb536933","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T19:55:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5bee434e3fb4c810be941e79afd04e7dbaee2f5195449cc7c0c0c358c2e68ea1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T19:55:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"61e3a6c3539ef45ffa4da6485c1bb6565794d8972e2f338e524c03c0bb536933","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T19:55:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"61e3a6c3539ef45ffa4da6485c1bb6565794d8972e2f338e524c03c0bb536933","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T19:55:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/61e3a6c3539ef45ffa4da6485c1bb6565794d8972e2f338e524c03c0bb536933"}
{"level":"debug","ts":"2026-07-02T19:55:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"61e3a6c3539ef45ffa4da6485c1bb6565794d8972e2f338e524c03c0bb536933","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T19:55:17Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T19:55:17Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["61e3a6c3539ef45ffa4da6485c1bb6565794d8972e2f338e524c03c0bb536933"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T19:55:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5bee434e3fb4c810be941e79afd04e7dbaee2f5195449cc7c0c0c358c2e68ea1"}
{"level":"info","ts":"2026-07-02T19:55:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"61e3a6c3539ef45ffa4da6485c1bb6565794d8972e2f338e524c03c0bb536933","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T19:55:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"61e3a6c3539ef45ffa4da6485c1bb6565794d8972e2f338e524c03c0bb536933","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T19:55:17Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T19:55:17Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T19:55:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/61e3a6c3539ef45ffa4da6485c1bb6565794d8972e2f338e524c03c0bb536933"}
{"level":"info","ts":"2026-07-02T19:55:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"61e3a6c3539ef45ffa4da6485c1bb6565794d8972e2f338e524c03c0bb536933","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T19:55:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"61e3a6c3539ef45ffa4da6485c1bb6565794d8972e2f338e524c03c0bb536933","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T19:55:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"61e3a6c3539ef45ffa4da6485c1bb6565794d8972e2f338e524c03c0bb536933","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T19:55:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/61e3a6c3539ef45ffa4da6485c1bb6565794d8972e2f338e524c03c0bb536933"}
{"level":"debug","ts":"2026-07-02T19:55:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"61e3a6c3539ef45ffa4da6485c1bb6565794d8972e2f338e524c03c0bb536933","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T19:55:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/61e3a6c3539ef45ffa4da6485c1bb6565794d8972e2f338e524c03c0bb536933"}
{"level":"debug","ts":"2026-07-02T19:55:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"61e3a6c3539ef45ffa4da6485c1bb6565794d8972e2f338e524c03c0bb536933","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T19:55:17Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T19:55:17Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["61e3a6c3539ef45ffa4da6485c1bb6565794d8972e2f338e524c03c0bb536933"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T19:55:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"61e3a6c3539ef45ffa4da6485c1bb6565794d8972e2f338e524c03c0bb536933","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T19:55:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"61e3a6c3539ef45ffa4da6485c1bb6565794d8972e2f338e524c03c0bb536933","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T19:55:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/61e3a6c3539ef45ffa4da6485c1bb6565794d8972e2f338e524c03c0bb536933"}
{"level":"debug","ts":"2026-07-02T19:55:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7403e9577842df610c24958c550c0fe966eb94e2ebe3883f1550e011b2f4217d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T19:55:29Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T19:55:29Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T19:55:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7403e9577842df610c24958c550c0fe966eb94e2ebe3883f1550e011b2f4217d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T19:55:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7403e9577842df610c24958c550c0fe966eb94e2ebe3883f1550e011b2f4217d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T19:55:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7403e9577842df610c24958c550c0fe966eb94e2ebe3883f1550e011b2f4217d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T19:55:29Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7403e9577842df610c24958c550c0fe966eb94e2ebe3883f1550e011b2f4217d"}
{"level":"debug","ts":"2026-07-02T19:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7403e9577842df610c24958c550c0fe966eb94e2ebe3883f1550e011b2f4217d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T19:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7403e9577842df610c24958c550c0fe966eb94e2ebe3883f1550e011b2f4217d"}
{"level":"debug","ts":"2026-07-02T19:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7403e9577842df610c24958c550c0fe966eb94e2ebe3883f1550e011b2f4217d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T19:55:30Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T19:55:30Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["7403e9577842df610c24958c550c0fe966eb94e2ebe3883f1550e011b2f4217d"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T19:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7403e9577842df610c24958c550c0fe966eb94e2ebe3883f1550e011b2f4217d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T19:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7403e9577842df610c24958c550c0fe966eb94e2ebe3883f1550e011b2f4217d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T19:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7403e9577842df610c24958c550c0fe966eb94e2ebe3883f1550e011b2f4217d"}
{"level":"debug","ts":"2026-07-02T19:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"21203a2b1d9dd6b10ed90520f7b45e8e896fed96c318c1d69be590568f896fc4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T19:55:30Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T19:55:30Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T19:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"21203a2b1d9dd6b10ed90520f7b45e8e896fed96c318c1d69be590568f896fc4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T19:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"21203a2b1d9dd6b10ed90520f7b45e8e896fed96c318c1d69be590568f896fc4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T19:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"21203a2b1d9dd6b10ed90520f7b45e8e896fed96c318c1d69be590568f896fc4","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T19:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/21203a2b1d9dd6b10ed90520f7b45e8e896fed96c318c1d69be590568f896fc4"}
{"level":"debug","ts":"2026-07-02T19:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"21203a2b1d9dd6b10ed90520f7b45e8e896fed96c318c1d69be590568f896fc4","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T19:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/21203a2b1d9dd6b10ed90520f7b45e8e896fed96c318c1d69be590568f896fc4"}
{"level":"debug","ts":"2026-07-02T19:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"21203a2b1d9dd6b10ed90520f7b45e8e896fed96c318c1d69be590568f896fc4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T19:55:30Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T19:55:30Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["21203a2b1d9dd6b10ed90520f7b45e8e896fed96c318c1d69be590568f896fc4"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T19:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"21203a2b1d9dd6b10ed90520f7b45e8e896fed96c318c1d69be590568f896fc4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T19:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"21203a2b1d9dd6b10ed90520f7b45e8e896fed96c318c1d69be590568f896fc4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T19:55:30Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T19:55:30Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T19:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"21203a2b1d9dd6b10ed90520f7b45e8e896fed96c318c1d69be590568f896fc4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T19:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"21203a2b1d9dd6b10ed90520f7b45e8e896fed96c318c1d69be590568f896fc4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T19:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"21203a2b1d9dd6b10ed90520f7b45e8e896fed96c318c1d69be590568f896fc4","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T19:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/21203a2b1d9dd6b10ed90520f7b45e8e896fed96c318c1d69be590568f896fc4"}
{"level":"debug","ts":"2026-07-02T19:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"21203a2b1d9dd6b10ed90520f7b45e8e896fed96c318c1d69be590568f896fc4","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T19:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/21203a2b1d9dd6b10ed90520f7b45e8e896fed96c318c1d69be590568f896fc4"}
{"level":"debug","ts":"2026-07-02T19:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"21203a2b1d9dd6b10ed90520f7b45e8e896fed96c318c1d69be590568f896fc4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T19:55:30Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T19:55:30Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["21203a2b1d9dd6b10ed90520f7b45e8e896fed96c318c1d69be590568f896fc4"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T19:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"21203a2b1d9dd6b10ed90520f7b45e8e896fed96c318c1d69be590568f896fc4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T19:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"21203a2b1d9dd6b10ed90520f7b45e8e896fed96c318c1d69be590568f896fc4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T19:55:30Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T19:55:30Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T19:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"21203a2b1d9dd6b10ed90520f7b45e8e896fed96c318c1d69be590568f896fc4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T19:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"21203a2b1d9dd6b10ed90520f7b45e8e896fed96c318c1d69be590568f896fc4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T19:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"21203a2b1d9dd6b10ed90520f7b45e8e896fed96c318c1d69be590568f896fc4","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T19:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/21203a2b1d9dd6b10ed90520f7b45e8e896fed96c318c1d69be590568f896fc4"}
{"level":"debug","ts":"2026-07-02T19:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"21203a2b1d9dd6b10ed90520f7b45e8e896fed96c318c1d69be590568f896fc4","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T19:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/21203a2b1d9dd6b10ed90520f7b45e8e896fed96c318c1d69be590568f896fc4"}
{"level":"debug","ts":"2026-07-02T19:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"21203a2b1d9dd6b10ed90520f7b45e8e896fed96c318c1d69be590568f896fc4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T19:55:30Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T19:55:30Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["21203a2b1d9dd6b10ed90520f7b45e8e896fed96c318c1d69be590568f896fc4"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T19:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"21203a2b1d9dd6b10ed90520f7b45e8e896fed96c318c1d69be590568f896fc4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T19:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"21203a2b1d9dd6b10ed90520f7b45e8e896fed96c318c1d69be590568f896fc4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T19:55:30Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T19:55:30Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T19:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"21203a2b1d9dd6b10ed90520f7b45e8e896fed96c318c1d69be590568f896fc4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T19:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"21203a2b1d9dd6b10ed90520f7b45e8e896fed96c318c1d69be590568f896fc4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T19:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"21203a2b1d9dd6b10ed90520f7b45e8e896fed96c318c1d69be590568f896fc4","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T19:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/21203a2b1d9dd6b10ed90520f7b45e8e896fed96c318c1d69be590568f896fc4"}
{"level":"debug","ts":"2026-07-02T19:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"21203a2b1d9dd6b10ed90520f7b45e8e896fed96c318c1d69be590568f896fc4","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T19:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/21203a2b1d9dd6b10ed90520f7b45e8e896fed96c318c1d69be590568f896fc4"}
{"level":"debug","ts":"2026-07-02T19:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"21203a2b1d9dd6b10ed90520f7b45e8e896fed96c318c1d69be590568f896fc4","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T19:55:30Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T19:55:30Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["21203a2b1d9dd6b10ed90520f7b45e8e896fed96c318c1d69be590568f896fc4"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T19:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"21203a2b1d9dd6b10ed90520f7b45e8e896fed96c318c1d69be590568f896fc4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T19:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2c687b9cbfd095dffaab243dc13bfb681ae35c372d4b4d7e6fc20d080b272c97","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T19:55:30Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T19:55:30Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T19:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2c687b9cbfd095dffaab243dc13bfb681ae35c372d4b4d7e6fc20d080b272c97","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T19:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"21203a2b1d9dd6b10ed90520f7b45e8e896fed96c318c1d69be590568f896fc4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T19:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2c687b9cbfd095dffaab243dc13bfb681ae35c372d4b4d7e6fc20d080b272c97","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T19:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2c687b9cbfd095dffaab243dc13bfb681ae35c372d4b4d7e6fc20d080b272c97"}
{"level":"debug","ts":"2026-07-02T19:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2c687b9cbfd095dffaab243dc13bfb681ae35c372d4b4d7e6fc20d080b272c97","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T19:55:30Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T19:55:30Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["2c687b9cbfd095dffaab243dc13bfb681ae35c372d4b4d7e6fc20d080b272c97"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T19:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2c687b9cbfd095dffaab243dc13bfb681ae35c372d4b4d7e6fc20d080b272c97","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T19:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2c687b9cbfd095dffaab243dc13bfb681ae35c372d4b4d7e6fc20d080b272c97","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T19:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/21203a2b1d9dd6b10ed90520f7b45e8e896fed96c318c1d69be590568f896fc4"}
{"level":"info","ts":"2026-07-02T19:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2c687b9cbfd095dffaab243dc13bfb681ae35c372d4b4d7e6fc20d080b272c97"}
{"level":"debug","ts":"2026-07-02T19:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"524e482e9b350cd4a5920d8a8e171b6fc0a8d474aac0c8cc61fe4caa546ff0c5","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T19:55:30Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T19:55:30Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T19:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"524e482e9b350cd4a5920d8a8e171b6fc0a8d474aac0c8cc61fe4caa546ff0c5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T19:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"524e482e9b350cd4a5920d8a8e171b6fc0a8d474aac0c8cc61fe4caa546ff0c5","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T19:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/524e482e9b350cd4a5920d8a8e171b6fc0a8d474aac0c8cc61fe4caa546ff0c5"}
{"level":"debug","ts":"2026-07-02T19:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"524e482e9b350cd4a5920d8a8e171b6fc0a8d474aac0c8cc61fe4caa546ff0c5","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T19:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/524e482e9b350cd4a5920d8a8e171b6fc0a8d474aac0c8cc61fe4caa546ff0c5"}
{"level":"debug","ts":"2026-07-02T19:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"524e482e9b350cd4a5920d8a8e171b6fc0a8d474aac0c8cc61fe4caa546ff0c5","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T19:55:30Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T19:55:30Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["524e482e9b350cd4a5920d8a8e171b6fc0a8d474aac0c8cc61fe4caa546ff0c5"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T19:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"524e482e9b350cd4a5920d8a8e171b6fc0a8d474aac0c8cc61fe4caa546ff0c5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T19:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"524e482e9b350cd4a5920d8a8e171b6fc0a8d474aac0c8cc61fe4caa546ff0c5","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T19:55:30Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T19:55:30Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T19:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"524e482e9b350cd4a5920d8a8e171b6fc0a8d474aac0c8cc61fe4caa546ff0c5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T19:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"524e482e9b350cd4a5920d8a8e171b6fc0a8d474aac0c8cc61fe4caa546ff0c5","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T19:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/524e482e9b350cd4a5920d8a8e171b6fc0a8d474aac0c8cc61fe4caa546ff0c5"}
{"level":"debug","ts":"2026-07-02T19:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"524e482e9b350cd4a5920d8a8e171b6fc0a8d474aac0c8cc61fe4caa546ff0c5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T19:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4d1ebcf330c3033aeae7ddf320ff9d9e3b36d481a05cb004790d88f496b86f65","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T19:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/524e482e9b350cd4a5920d8a8e171b6fc0a8d474aac0c8cc61fe4caa546ff0c5"}
{"level":"debug","ts":"2026-07-02T19:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"524e482e9b350cd4a5920d8a8e171b6fc0a8d474aac0c8cc61fe4caa546ff0c5","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T19:55:30Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T19:55:30Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["524e482e9b350cd4a5920d8a8e171b6fc0a8d474aac0c8cc61fe4caa546ff0c5"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T19:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"524e482e9b350cd4a5920d8a8e171b6fc0a8d474aac0c8cc61fe4caa546ff0c5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T19:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a66bfc1423e1fc9a805cf4b32d17a0741138eb4e48024d53a7167d597d09a41e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T19:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"524e482e9b350cd4a5920d8a8e171b6fc0a8d474aac0c8cc61fe4caa546ff0c5","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T19:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4d1ebcf330c3033aeae7ddf320ff9d9e3b36d481a05cb004790d88f496b86f65"}
{"level":"info","ts":"2026-07-02T19:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a66bfc1423e1fc9a805cf4b32d17a0741138eb4e48024d53a7167d597d09a41e"}
{"level":"info","ts":"2026-07-02T19:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/524e482e9b350cd4a5920d8a8e171b6fc0a8d474aac0c8cc61fe4caa546ff0c5"}
{"level":"debug","ts":"2026-07-02T19:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c12297ed5d610842fbdc3a8db846ea6fc7a2850cf4e227c7fba355a8f7891d78","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T19:55:30Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c12297ed5d610842fbdc3a8db846ea6fc7a2850cf4e227c7fba355a8f7891d78"}
{"level":"debug","ts":"2026-07-02T19:55:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6c6cd617b6ed1a799a035f3cbf3949bd120c307dff8a0d3097073f86022d221d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T19:55:31Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T19:55:31Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T19:55:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6c6cd617b6ed1a799a035f3cbf3949bd120c307dff8a0d3097073f86022d221d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T19:55:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6c6cd617b6ed1a799a035f3cbf3949bd120c307dff8a0d3097073f86022d221d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T19:55:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"61e3a6c3539ef45ffa4da6485c1bb6565794d8972e2f338e524c03c0bb536933","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T19:55:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6c6cd617b6ed1a799a035f3cbf3949bd120c307dff8a0d3097073f86022d221d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T19:55:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6c6cd617b6ed1a799a035f3cbf3949bd120c307dff8a0d3097073f86022d221d"}
{"level":"debug","ts":"2026-07-02T19:55:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"bf07081b2f04f8e2498a6b067ead17b921dbb2092c0347ea564afbca68bfbad4","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T19:55:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6c6cd617b6ed1a799a035f3cbf3949bd120c307dff8a0d3097073f86022d221d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T19:55:31Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T19:55:31Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["6c6cd617b6ed1a799a035f3cbf3949bd120c307dff8a0d3097073f86022d221d"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T19:55:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/61e3a6c3539ef45ffa4da6485c1bb6565794d8972e2f338e524c03c0bb536933"}
{"level":"info","ts":"2026-07-02T19:55:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6c6cd617b6ed1a799a035f3cbf3949bd120c307dff8a0d3097073f86022d221d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T19:55:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5bee434e3fb4c810be941e79afd04e7dbaee2f5195449cc7c0c0c358c2e68ea1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T19:55:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6c6cd617b6ed1a799a035f3cbf3949bd120c307dff8a0d3097073f86022d221d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T19:55:31Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T19:55:31Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T19:55:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6c6cd617b6ed1a799a035f3cbf3949bd120c307dff8a0d3097073f86022d221d"}
{"level":"info","ts":"2026-07-02T19:55:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6c6cd617b6ed1a799a035f3cbf3949bd120c307dff8a0d3097073f86022d221d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T19:55:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"caa12846d6c7a46b153067b92cc28abbbe30621e60acec1a86f3d6b9b9e8ba43","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T19:55:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6c6cd617b6ed1a799a035f3cbf3949bd120c307dff8a0d3097073f86022d221d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T19:55:31Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T19:55:31Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["6c6cd617b6ed1a799a035f3cbf3949bd120c307dff8a0d3097073f86022d221d"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T19:55:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6c6cd617b6ed1a799a035f3cbf3949bd120c307dff8a0d3097073f86022d221d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T19:55:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6c6cd617b6ed1a799a035f3cbf3949bd120c307dff8a0d3097073f86022d221d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T19:55:31Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T19:55:31Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["6c6cd617b6ed1a799a035f3cbf3949bd120c307dff8a0d3097073f86022d221d"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T19:55:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/bf07081b2f04f8e2498a6b067ead17b921dbb2092c0347ea564afbca68bfbad4"}
{"level":"error","ts":"2026-07-02T19:55:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"6c6cd617b6ed1a799a035f3cbf3949bd120c307dff8a0d3097073f86022d221d","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"6c6cd617b6ed1a799a035f3cbf3949bd120c307dff8a0d3097073f86022d221d\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-02T19:55:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6c6cd617b6ed1a799a035f3cbf3949bd120c307dff8a0d3097073f86022d221d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T19:55:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6c6cd617b6ed1a799a035f3cbf3949bd120c307dff8a0d3097073f86022d221d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T19:55:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5373979ea596dbbc9247fb4c839f56cf020e689865c889156df7a87908999737","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T19:55:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5bee434e3fb4c810be941e79afd04e7dbaee2f5195449cc7c0c0c358c2e68ea1"}
{"level":"debug","ts":"2026-07-02T19:55:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a7bc781ee50a080e4b1837e6233657e1f6945b0ab3c1212b87a35a342dd4b376","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T19:55:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/caa12846d6c7a46b153067b92cc28abbbe30621e60acec1a86f3d6b9b9e8ba43"}
{"level":"debug","ts":"2026-07-02T19:55:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9d17cc73f0a37e8116def3b6a5a1c5072c2f0ee6575d0f90891c708d29be8ddd","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T19:55:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b5bda487471bfce70869c69093b8009a469502e2d629bb4845ee0731e518c59b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T19:55:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6c6cd617b6ed1a799a035f3cbf3949bd120c307dff8a0d3097073f86022d221d"}
{"level":"info","ts":"2026-07-02T19:55:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5373979ea596dbbc9247fb4c839f56cf020e689865c889156df7a87908999737"}
{"level":"info","ts":"2026-07-02T19:55:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a7bc781ee50a080e4b1837e6233657e1f6945b0ab3c1212b87a35a342dd4b376"}
{"level":"debug","ts":"2026-07-02T19:55:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e9c3ec971c613f21f6413aaaac21d1f364df0a50e85ec0a52545937d445f9eac","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T19:55:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"28bef88d32f2cd20b5010f450b5a34f7c27b94d332e4cf61cf41d73157d195a4","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T19:55:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9d17cc73f0a37e8116def3b6a5a1c5072c2f0ee6575d0f90891c708d29be8ddd"}
{"level":"debug","ts":"2026-07-02T19:55:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"71a1eb8a6f1d34ffb8de608759ef0a698162fb6985064a3e3484849c721bad6a","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T19:55:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b5bda487471bfce70869c69093b8009a469502e2d629bb4845ee0731e518c59b"}
{"level":"info","ts":"2026-07-02T19:55:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e9c3ec971c613f21f6413aaaac21d1f364df0a50e85ec0a52545937d445f9eac"}
{"level":"info","ts":"2026-07-02T19:55:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/28bef88d32f2cd20b5010f450b5a34f7c27b94d332e4cf61cf41d73157d195a4"}
{"level":"info","ts":"2026-07-02T19:55:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/71a1eb8a6f1d34ffb8de608759ef0a698162fb6985064a3e3484849c721bad6a"}
{"level":"debug","ts":"2026-07-02T19:55:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"850534fa0cdbb991bfb075008d3225736952c988937168c31d24c62f51ce43b3","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T19:55:31Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T19:55:31Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T19:55:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"850534fa0cdbb991bfb075008d3225736952c988937168c31d24c62f51ce43b3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T19:55:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"850534fa0cdbb991bfb075008d3225736952c988937168c31d24c62f51ce43b3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T19:55:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"850534fa0cdbb991bfb075008d3225736952c988937168c31d24c62f51ce43b3","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T19:55:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/850534fa0cdbb991bfb075008d3225736952c988937168c31d24c62f51ce43b3"}
{"level":"debug","ts":"2026-07-02T19:55:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"850534fa0cdbb991bfb075008d3225736952c988937168c31d24c62f51ce43b3","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T19:55:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/850534fa0cdbb991bfb075008d3225736952c988937168c31d24c62f51ce43b3"}
{"level":"debug","ts":"2026-07-02T19:55:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"850534fa0cdbb991bfb075008d3225736952c988937168c31d24c62f51ce43b3","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T19:55:31Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T19:55:31Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["850534fa0cdbb991bfb075008d3225736952c988937168c31d24c62f51ce43b3"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T19:55:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"850534fa0cdbb991bfb075008d3225736952c988937168c31d24c62f51ce43b3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T19:55:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"850534fa0cdbb991bfb075008d3225736952c988937168c31d24c62f51ce43b3","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T19:55:31Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T19:55:31Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T19:55:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"850534fa0cdbb991bfb075008d3225736952c988937168c31d24c62f51ce43b3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T19:55:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"850534fa0cdbb991bfb075008d3225736952c988937168c31d24c62f51ce43b3","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T19:55:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/850534fa0cdbb991bfb075008d3225736952c988937168c31d24c62f51ce43b3"}
{"level":"debug","ts":"2026-07-02T19:55:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"850534fa0cdbb991bfb075008d3225736952c988937168c31d24c62f51ce43b3","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T19:55:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/850534fa0cdbb991bfb075008d3225736952c988937168c31d24c62f51ce43b3"}
{"level":"debug","ts":"2026-07-02T19:55:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"850534fa0cdbb991bfb075008d3225736952c988937168c31d24c62f51ce43b3","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T19:55:31Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T19:55:31Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["850534fa0cdbb991bfb075008d3225736952c988937168c31d24c62f51ce43b3"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T19:55:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"850534fa0cdbb991bfb075008d3225736952c988937168c31d24c62f51ce43b3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T19:55:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"850534fa0cdbb991bfb075008d3225736952c988937168c31d24c62f51ce43b3","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T19:55:31Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T19:55:31Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T19:55:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"850534fa0cdbb991bfb075008d3225736952c988937168c31d24c62f51ce43b3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T19:55:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"850534fa0cdbb991bfb075008d3225736952c988937168c31d24c62f51ce43b3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T19:55:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"850534fa0cdbb991bfb075008d3225736952c988937168c31d24c62f51ce43b3","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T19:55:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/850534fa0cdbb991bfb075008d3225736952c988937168c31d24c62f51ce43b3"}
{"level":"debug","ts":"2026-07-02T19:55:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"850534fa0cdbb991bfb075008d3225736952c988937168c31d24c62f51ce43b3","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T19:55:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/850534fa0cdbb991bfb075008d3225736952c988937168c31d24c62f51ce43b3"}
{"level":"debug","ts":"2026-07-02T19:55:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"850534fa0cdbb991bfb075008d3225736952c988937168c31d24c62f51ce43b3","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T19:55:31Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T19:55:31Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["850534fa0cdbb991bfb075008d3225736952c988937168c31d24c62f51ce43b3"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T19:55:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"850534fa0cdbb991bfb075008d3225736952c988937168c31d24c62f51ce43b3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T19:55:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"850534fa0cdbb991bfb075008d3225736952c988937168c31d24c62f51ce43b3","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-02T19:55:31Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-02T19:55:31Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T19:55:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"850534fa0cdbb991bfb075008d3225736952c988937168c31d24c62f51ce43b3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T19:55:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"850534fa0cdbb991bfb075008d3225736952c988937168c31d24c62f51ce43b3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T19:55:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"850534fa0cdbb991bfb075008d3225736952c988937168c31d24c62f51ce43b3","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T19:55:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/850534fa0cdbb991bfb075008d3225736952c988937168c31d24c62f51ce43b3"}
{"level":"debug","ts":"2026-07-02T19:55:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"850534fa0cdbb991bfb075008d3225736952c988937168c31d24c62f51ce43b3","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T19:55:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/850534fa0cdbb991bfb075008d3225736952c988937168c31d24c62f51ce43b3"}
{"level":"debug","ts":"2026-07-02T19:55:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"850534fa0cdbb991bfb075008d3225736952c988937168c31d24c62f51ce43b3","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-02T19:55:31Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-02T19:55:31Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["850534fa0cdbb991bfb075008d3225736952c988937168c31d24c62f51ce43b3"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-02T19:55:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"850534fa0cdbb991bfb075008d3225736952c988937168c31d24c62f51ce43b3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-02T19:55:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"850534fa0cdbb991bfb075008d3225736952c988937168c31d24c62f51ce43b3","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-02T19:55:31Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/850534fa0cdbb991bfb075008d3225736952c988937168c31d24c62f51ce43b3"}
{"level":"info","ts":"2026-07-02T19:55:33Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a82ad592-b603-4419-94f0-2973b83b37d7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.11:49792","PortSpecifier":{"PortValue":49792}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"a82ad592-b603-4419-94f0-2973b83b37d7","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-2fca4d.apps.f37af604-827d-4b1e-b2e7-a43ddf26f5c0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T19:55:33Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a82ad592-b603-4419-94f0-2973b83b37d7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.11:49792","PortSpecifier":{"PortValue":49792}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783022133,"nanos":422398443},"http":{"id":"a82ad592-b603-4419-94f0-2973b83b37d7","method":"POST","headers":{":authority":"e2e-shared-a-2fca4d.apps.f37af604-827d-4b1e-b2e7-a43ddf26f5c0.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T19:55:33Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"a82ad592-b603-4419-94f0-2973b83b37d7","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-02T19:55:33Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"a82ad592-b603-4419-94f0-2973b83b37d7","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"0536fa78-b0fd-455c-8bfe-dafac27ee5d8","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=9537c20b-690b-4316-9ac6-92de6c4d42fa"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/a43ddf26f5c0"]}}
{"level":"debug","ts":"2026-07-02T19:55:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"a82ad592-b603-4419-94f0-2973b83b37d7","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/a43ddf26f5c0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=9537c20b-690b-4316-9ac6-92de6c4d42fa"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"0536fa78-b0fd-455c-8bfe-dafac27ee5d8","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"a7bc781ee50a080e4b1837e6233657e1f6945b0ab3c1212b87a35a342dd4b376"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.44:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-2fca4d.apps.f37af604-827d-4b1e-b2e7-a43ddf26f5c0.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T19:55:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a82ad592-b603-4419-94f0-2973b83b37d7","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T19:55:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a82ad592-b603-4419-94f0-2973b83b37d7","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T19:55:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a82ad592-b603-4419-94f0-2973b83b37d7","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-2fca4d/rate-test-model-2fca4d\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T19:55:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"a82ad592-b603-4419-94f0-2973b83b37d7","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-02T19:55:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a82ad592-b603-4419-94f0-2973b83b37d7","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-02T19:55:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a82ad592-b603-4419-94f0-2973b83b37d7","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-02T19:55:33Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a82ad592-b603-4419-94f0-2973b83b37d7","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T19:55:33Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a82ad592-b603-4419-94f0-2973b83b37d7","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T19:55:33Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"bfa7449b-7b09-44c7-a71b-a822bccf084f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.11:53952","PortSpecifier":{"PortValue":53952}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.46:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"bfa7449b-7b09-44c7-a71b-a822bccf084f","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-f9d728.apps.f37af604-827d-4b1e-b2e7-a43ddf26f5c0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T19:55:33Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"bfa7449b-7b09-44c7-a71b-a822bccf084f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.11:53952","PortSpecifier":{"PortValue":53952}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.46:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783022133,"nanos":469223943},"http":{"id":"bfa7449b-7b09-44c7-a71b-a822bccf084f","method":"POST","headers":{":authority":"e2e-shared-b-f9d728.apps.f37af604-827d-4b1e-b2e7-a43ddf26f5c0.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T19:55:33Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"bfa7449b-7b09-44c7-a71b-a822bccf084f","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-02T19:55:33Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"bfa7449b-7b09-44c7-a71b-a822bccf084f","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"0536fa78-b0fd-455c-8bfe-dafac27ee5d8","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=9537c20b-690b-4316-9ac6-92de6c4d42fa"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/a43ddf26f5c0"]}}
{"level":"debug","ts":"2026-07-02T19:55:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"bfa7449b-7b09-44c7-a71b-a822bccf084f","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/a43ddf26f5c0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=9537c20b-690b-4316-9ac6-92de6c4d42fa"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"0536fa78-b0fd-455c-8bfe-dafac27ee5d8","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"a66bfc1423e1fc9a805cf4b32d17a0741138eb4e48024d53a7167d597d09a41e"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.46:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-f9d728.apps.f37af604-827d-4b1e-b2e7-a43ddf26f5c0.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T19:55:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"bfa7449b-7b09-44c7-a71b-a822bccf084f","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T19:55:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"bfa7449b-7b09-44c7-a71b-a822bccf084f","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T19:55:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"bfa7449b-7b09-44c7-a71b-a822bccf084f","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-f9d728/rate-test-model-f9d728\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T19:55:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"bfa7449b-7b09-44c7-a71b-a822bccf084f","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-02T19:55:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"bfa7449b-7b09-44c7-a71b-a822bccf084f","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-02T19:55:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"bfa7449b-7b09-44c7-a71b-a822bccf084f","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-02T19:55:33Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"bfa7449b-7b09-44c7-a71b-a822bccf084f","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T19:55:33Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"bfa7449b-7b09-44c7-a71b-a822bccf084f","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T19:55:33Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"46a32f5f-8ca1-40c4-932a-6cde38c46f4f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.11:49808","PortSpecifier":{"PortValue":49808}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"46a32f5f-8ca1-40c4-932a-6cde38c46f4f","method":"POST","path":"/ai-tenant-e2e-shared-a-2fca4d/rate-test-model-2fca4d/v1/completions","host":"e2e-shared-a-2fca4d.apps.f37af604-827d-4b1e-b2e7-a43ddf26f5c0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T19:55:33Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"46a32f5f-8ca1-40c4-932a-6cde38c46f4f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.11:49808","PortSpecifier":{"PortValue":49808}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783022133,"nanos":504813432},"http":{"id":"46a32f5f-8ca1-40c4-932a-6cde38c46f4f","method":"POST","headers":{":authority":"e2e-shared-a-2fca4d.apps.f37af604-827d-4b1e-b2e7-a43ddf26f5c0.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-2fca4d/rate-test-model-2fca4d/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T19:55:33Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"46a32f5f-8ca1-40c4-932a-6cde38c46f4f","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-19JmHHIEuRtrVoIvR_rWORNPNAu4KXiha8HqvJEQmj0DEWdkcPUPR8ghAFle3"}
{"level":"debug","ts":"2026-07-02T19:55:33Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"46a32f5f-8ca1-40c4-932a-6cde38c46f4f","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-2fca4d.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-19JmHHIEuRtrVoIvR_rWORNPNAu4KXiha8HqvJEQmj0DEWdkcPUPR8ghAFle3\"}"}
{"level":"debug","ts":"2026-07-02T19:55:33Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"46a32f5f-8ca1-40c4-932a-6cde38c46f4f","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-2fca4d.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"dbff1889-8ed7-4188-8266-3d4fc41a01f6","keyName":"e2e-rate-a-50fe4f","subscription":"e2e-rate-iso-a-50fe4f","tenant":"e2e-shared-a-2fca4d","userId":"dbff1889-8ed7-4188-8266-3d4fc41a01f6","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-02T19:55:33Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"46a32f5f-8ca1-40c4-932a-6cde38c46f4f","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-2fca4d.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-2fca4d/rate-test-model-2fca4d\",\"requestedSubscription\":\"e2e-rate-iso-a-50fe4f\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-02T19:55:33Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"46a32f5f-8ca1-40c4-932a-6cde38c46f4f","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-2fca4d.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-2fca4d","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-50fe4f","namespace":"ai-tenant-e2e-shared-a-2fca4d","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-02T19:55:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"46a32f5f-8ca1-40c4-932a-6cde38c46f4f","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T19:55:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"46a32f5f-8ca1-40c4-932a-6cde38c46f4f","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T19:55:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"46a32f5f-8ca1-40c4-932a-6cde38c46f4f","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T19:55:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"46a32f5f-8ca1-40c4-932a-6cde38c46f4f","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-2fca4d/rate-test-model-2fca4d\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T19:55:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"46a32f5f-8ca1-40c4-932a-6cde38c46f4f","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T19:55:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"46a32f5f-8ca1-40c4-932a-6cde38c46f4f","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-02T19:55:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"46a32f5f-8ca1-40c4-932a-6cde38c46f4f","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-50fe4f"}
{"level":"debug","ts":"2026-07-02T19:55:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"46a32f5f-8ca1-40c4-932a-6cde38c46f4f","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-02T19:55:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"46a32f5f-8ca1-40c4-932a-6cde38c46f4f","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"dbff1889-8ed7-4188-8266-3d4fc41a01f6","keyName":"e2e-rate-a-50fe4f","selected_subscription":"e2e-rate-iso-a-50fe4f","selected_subscription_key":"ai-tenant-e2e-shared-a-2fca4d/e2e-rate-iso-a-50fe4f@ai-tenant-e2e-shared-a-2fca4d/rate-test-model-2fca4d","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-2fca4d","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-50fe4f","namespace":"ai-tenant-e2e-shared-a-2fca4d","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-02T19:55:33Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"46a32f5f-8ca1-40c4-932a-6cde38c46f4f","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T19:55:33Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"46a32f5f-8ca1-40c4-932a-6cde38c46f4f","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T19:55:34Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b1b189bd-cf0b-4320-a516-05e91234e62a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.11:49814","PortSpecifier":{"PortValue":49814}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"b1b189bd-cf0b-4320-a516-05e91234e62a","method":"POST","path":"/ai-tenant-e2e-shared-a-2fca4d/rate-test-model-2fca4d/v1/completions","host":"e2e-shared-a-2fca4d.apps.f37af604-827d-4b1e-b2e7-a43ddf26f5c0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T19:55:34Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b1b189bd-cf0b-4320-a516-05e91234e62a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.11:49814","PortSpecifier":{"PortValue":49814}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783022134,"nanos":556166301},"http":{"id":"b1b189bd-cf0b-4320-a516-05e91234e62a","method":"POST","headers":{":authority":"e2e-shared-a-2fca4d.apps.f37af604-827d-4b1e-b2e7-a43ddf26f5c0.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-2fca4d/rate-test-model-2fca4d/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T19:55:34Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"b1b189bd-cf0b-4320-a516-05e91234e62a","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-19JmHHIEuRtrVoIvR_rWORNPNAu4KXiha8HqvJEQmj0DEWdkcPUPR8ghAFle3"}
{"level":"debug","ts":"2026-07-02T19:55:34Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"b1b189bd-cf0b-4320-a516-05e91234e62a","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-2fca4d.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-19JmHHIEuRtrVoIvR_rWORNPNAu4KXiha8HqvJEQmj0DEWdkcPUPR8ghAFle3\"}"}
{"level":"debug","ts":"2026-07-02T19:55:34Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"b1b189bd-cf0b-4320-a516-05e91234e62a","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-2fca4d.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"dbff1889-8ed7-4188-8266-3d4fc41a01f6","keyName":"e2e-rate-a-50fe4f","subscription":"e2e-rate-iso-a-50fe4f","tenant":"e2e-shared-a-2fca4d","userId":"dbff1889-8ed7-4188-8266-3d4fc41a01f6","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-02T19:55:34Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"b1b189bd-cf0b-4320-a516-05e91234e62a","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-2fca4d.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-2fca4d/rate-test-model-2fca4d\",\"requestedSubscription\":\"e2e-rate-iso-a-50fe4f\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-02T19:55:34Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"b1b189bd-cf0b-4320-a516-05e91234e62a","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-2fca4d.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-2fca4d","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-50fe4f","namespace":"ai-tenant-e2e-shared-a-2fca4d","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-02T19:55:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"b1b189bd-cf0b-4320-a516-05e91234e62a","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T19:55:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b1b189bd-cf0b-4320-a516-05e91234e62a","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T19:55:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b1b189bd-cf0b-4320-a516-05e91234e62a","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T19:55:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b1b189bd-cf0b-4320-a516-05e91234e62a","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T19:55:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b1b189bd-cf0b-4320-a516-05e91234e62a","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-2fca4d/rate-test-model-2fca4d\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T19:55:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b1b189bd-cf0b-4320-a516-05e91234e62a","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-02T19:55:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b1b189bd-cf0b-4320-a516-05e91234e62a","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-02T19:55:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b1b189bd-cf0b-4320-a516-05e91234e62a","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-50fe4f"}
{"level":"debug","ts":"2026-07-02T19:55:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b1b189bd-cf0b-4320-a516-05e91234e62a","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"dbff1889-8ed7-4188-8266-3d4fc41a01f6","keyName":"e2e-rate-a-50fe4f","selected_subscription":"e2e-rate-iso-a-50fe4f","selected_subscription_key":"ai-tenant-e2e-shared-a-2fca4d/e2e-rate-iso-a-50fe4f@ai-tenant-e2e-shared-a-2fca4d/rate-test-model-2fca4d","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-2fca4d","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-50fe4f","namespace":"ai-tenant-e2e-shared-a-2fca4d","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-02T19:55:34Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b1b189bd-cf0b-4320-a516-05e91234e62a","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T19:55:34Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b1b189bd-cf0b-4320-a516-05e91234e62a","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T19:55:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e53fa408-2a24-4bcc-ba89-c7b38a5cde7e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.11:49828","PortSpecifier":{"PortValue":49828}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"e53fa408-2a24-4bcc-ba89-c7b38a5cde7e","method":"POST","path":"/ai-tenant-e2e-shared-a-2fca4d/rate-test-model-2fca4d/v1/completions","host":"e2e-shared-a-2fca4d.apps.f37af604-827d-4b1e-b2e7-a43ddf26f5c0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T19:55:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e53fa408-2a24-4bcc-ba89-c7b38a5cde7e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.11:49828","PortSpecifier":{"PortValue":49828}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783022135,"nanos":595075256},"http":{"id":"e53fa408-2a24-4bcc-ba89-c7b38a5cde7e","method":"POST","headers":{":authority":"e2e-shared-a-2fca4d.apps.f37af604-827d-4b1e-b2e7-a43ddf26f5c0.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-2fca4d/rate-test-model-2fca4d/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T19:55:35Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"e53fa408-2a24-4bcc-ba89-c7b38a5cde7e","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-19JmHHIEuRtrVoIvR_rWORNPNAu4KXiha8HqvJEQmj0DEWdkcPUPR8ghAFle3"}
{"level":"debug","ts":"2026-07-02T19:55:35Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"e53fa408-2a24-4bcc-ba89-c7b38a5cde7e","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-2fca4d.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-19JmHHIEuRtrVoIvR_rWORNPNAu4KXiha8HqvJEQmj0DEWdkcPUPR8ghAFle3\"}"}
{"level":"debug","ts":"2026-07-02T19:55:35Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"e53fa408-2a24-4bcc-ba89-c7b38a5cde7e","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-2fca4d.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"dbff1889-8ed7-4188-8266-3d4fc41a01f6","keyName":"e2e-rate-a-50fe4f","subscription":"e2e-rate-iso-a-50fe4f","tenant":"e2e-shared-a-2fca4d","userId":"dbff1889-8ed7-4188-8266-3d4fc41a01f6","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-02T19:55:35Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"e53fa408-2a24-4bcc-ba89-c7b38a5cde7e","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-2fca4d.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-2fca4d/rate-test-model-2fca4d\",\"requestedSubscription\":\"e2e-rate-iso-a-50fe4f\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-02T19:55:35Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"e53fa408-2a24-4bcc-ba89-c7b38a5cde7e","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-2fca4d.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-2fca4d","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-50fe4f","namespace":"ai-tenant-e2e-shared-a-2fca4d","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-02T19:55:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"e53fa408-2a24-4bcc-ba89-c7b38a5cde7e","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T19:55:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e53fa408-2a24-4bcc-ba89-c7b38a5cde7e","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T19:55:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e53fa408-2a24-4bcc-ba89-c7b38a5cde7e","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T19:55:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e53fa408-2a24-4bcc-ba89-c7b38a5cde7e","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T19:55:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e53fa408-2a24-4bcc-ba89-c7b38a5cde7e","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-2fca4d/rate-test-model-2fca4d\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T19:55:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e53fa408-2a24-4bcc-ba89-c7b38a5cde7e","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-02T19:55:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e53fa408-2a24-4bcc-ba89-c7b38a5cde7e","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-50fe4f"}
{"level":"debug","ts":"2026-07-02T19:55:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e53fa408-2a24-4bcc-ba89-c7b38a5cde7e","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-02T19:55:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e53fa408-2a24-4bcc-ba89-c7b38a5cde7e","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"dbff1889-8ed7-4188-8266-3d4fc41a01f6","keyName":"e2e-rate-a-50fe4f","selected_subscription":"e2e-rate-iso-a-50fe4f","selected_subscription_key":"ai-tenant-e2e-shared-a-2fca4d/e2e-rate-iso-a-50fe4f@ai-tenant-e2e-shared-a-2fca4d/rate-test-model-2fca4d","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-2fca4d","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-50fe4f","namespace":"ai-tenant-e2e-shared-a-2fca4d","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-02T19:55:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e53fa408-2a24-4bcc-ba89-c7b38a5cde7e","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T19:55:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e53fa408-2a24-4bcc-ba89-c7b38a5cde7e","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T19:55:44Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5c97735c-377c-4004-a223-66db69512a8b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.11:57616","PortSpecifier":{"PortValue":57616}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"5c97735c-377c-4004-a223-66db69512a8b","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-2fca4d.apps.f37af604-827d-4b1e-b2e7-a43ddf26f5c0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T19:55:44Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5c97735c-377c-4004-a223-66db69512a8b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.11:57616","PortSpecifier":{"PortValue":57616}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783022144,"nanos":212994990},"http":{"id":"5c97735c-377c-4004-a223-66db69512a8b","method":"POST","headers":{":authority":"e2e-shared-a-2fca4d.apps.f37af604-827d-4b1e-b2e7-a43ddf26f5c0.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T19:55:44Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"5c97735c-377c-4004-a223-66db69512a8b","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-02T19:55:44Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"5c97735c-377c-4004-a223-66db69512a8b","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"0536fa78-b0fd-455c-8bfe-dafac27ee5d8","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=9537c20b-690b-4316-9ac6-92de6c4d42fa"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/a43ddf26f5c0"]}}
{"level":"debug","ts":"2026-07-02T19:55:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"5c97735c-377c-4004-a223-66db69512a8b","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/a43ddf26f5c0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=9537c20b-690b-4316-9ac6-92de6c4d42fa"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"0536fa78-b0fd-455c-8bfe-dafac27ee5d8","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"a7bc781ee50a080e4b1837e6233657e1f6945b0ab3c1212b87a35a342dd4b376"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.44:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-2fca4d.apps.f37af604-827d-4b1e-b2e7-a43ddf26f5c0.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T19:55:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5c97735c-377c-4004-a223-66db69512a8b","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T19:55:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5c97735c-377c-4004-a223-66db69512a8b","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T19:55:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5c97735c-377c-4004-a223-66db69512a8b","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-2fca4d/rate-test-model-2fca4d\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T19:55:44Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"5c97735c-377c-4004-a223-66db69512a8b","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-02T19:55:44Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5c97735c-377c-4004-a223-66db69512a8b","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-02T19:55:44Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5c97735c-377c-4004-a223-66db69512a8b","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-02T19:55:44Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5c97735c-377c-4004-a223-66db69512a8b","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T19:55:44Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5c97735c-377c-4004-a223-66db69512a8b","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T19:55:44Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2736454a-fec0-4b6b-bd85-5698f788ff8f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.11:60976","PortSpecifier":{"PortValue":60976}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.46:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"2736454a-fec0-4b6b-bd85-5698f788ff8f","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-f9d728.apps.f37af604-827d-4b1e-b2e7-a43ddf26f5c0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T19:55:44Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2736454a-fec0-4b6b-bd85-5698f788ff8f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.11:60976","PortSpecifier":{"PortValue":60976}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.46:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783022144,"nanos":251390093},"http":{"id":"2736454a-fec0-4b6b-bd85-5698f788ff8f","method":"POST","headers":{":authority":"e2e-shared-b-f9d728.apps.f37af604-827d-4b1e-b2e7-a43ddf26f5c0.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T19:55:44Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"2736454a-fec0-4b6b-bd85-5698f788ff8f","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-02T19:55:44Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"2736454a-fec0-4b6b-bd85-5698f788ff8f","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"0536fa78-b0fd-455c-8bfe-dafac27ee5d8","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=9537c20b-690b-4316-9ac6-92de6c4d42fa"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/a43ddf26f5c0"]}}
{"level":"debug","ts":"2026-07-02T19:55:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"2736454a-fec0-4b6b-bd85-5698f788ff8f","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/a43ddf26f5c0"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=9537c20b-690b-4316-9ac6-92de6c4d42fa"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"0536fa78-b0fd-455c-8bfe-dafac27ee5d8","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"a66bfc1423e1fc9a805cf4b32d17a0741138eb4e48024d53a7167d597d09a41e"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.46:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-f9d728.apps.f37af604-827d-4b1e-b2e7-a43ddf26f5c0.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T19:55:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2736454a-fec0-4b6b-bd85-5698f788ff8f","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T19:55:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2736454a-fec0-4b6b-bd85-5698f788ff8f","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T19:55:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2736454a-fec0-4b6b-bd85-5698f788ff8f","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-f9d728/rate-test-model-f9d728\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T19:55:44Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"2736454a-fec0-4b6b-bd85-5698f788ff8f","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-02T19:55:44Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2736454a-fec0-4b6b-bd85-5698f788ff8f","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-02T19:55:44Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2736454a-fec0-4b6b-bd85-5698f788ff8f","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-02T19:55:44Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2736454a-fec0-4b6b-bd85-5698f788ff8f","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T19:55:44Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2736454a-fec0-4b6b-bd85-5698f788ff8f","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T19:55:44Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6557a8d9-a32c-4b66-9a90-c1c2c20130b0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.11:57622","PortSpecifier":{"PortValue":57622}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"6557a8d9-a32c-4b66-9a90-c1c2c20130b0","method":"POST","path":"/ai-tenant-e2e-shared-a-2fca4d/rate-test-model-2fca4d/v1/completions","host":"e2e-shared-a-2fca4d.apps.f37af604-827d-4b1e-b2e7-a43ddf26f5c0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T19:55:44Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6557a8d9-a32c-4b66-9a90-c1c2c20130b0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.11:57622","PortSpecifier":{"PortValue":57622}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783022144,"nanos":287266219},"http":{"id":"6557a8d9-a32c-4b66-9a90-c1c2c20130b0","method":"POST","headers":{":authority":"e2e-shared-a-2fca4d.apps.f37af604-827d-4b1e-b2e7-a43ddf26f5c0.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-2fca4d/rate-test-model-2fca4d/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T19:55:44Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"6557a8d9-a32c-4b66-9a90-c1c2c20130b0","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-vDVRU7aTzX6tQ3r4_nqATQGcuRR2OkLBjUGFufj2bofY1oUbSxNQz1fh43VV"}
{"level":"debug","ts":"2026-07-02T19:55:44Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"6557a8d9-a32c-4b66-9a90-c1c2c20130b0","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-2fca4d.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-vDVRU7aTzX6tQ3r4_nqATQGcuRR2OkLBjUGFufj2bofY1oUbSxNQz1fh43VV\"}"}
{"level":"debug","ts":"2026-07-02T19:55:44Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"6557a8d9-a32c-4b66-9a90-c1c2c20130b0","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-2fca4d.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"1252fcaa-ccc0-4bff-be28-48510103f86b","keyName":"e2e-rate-a-cd3648","subscription":"e2e-rate-iso-a-cd3648","tenant":"e2e-shared-a-2fca4d","userId":"1252fcaa-ccc0-4bff-be28-48510103f86b","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-02T19:55:44Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"6557a8d9-a32c-4b66-9a90-c1c2c20130b0","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-2fca4d.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-2fca4d/rate-test-model-2fca4d\",\"requestedSubscription\":\"e2e-rate-iso-a-cd3648\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-02T19:55:44Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"6557a8d9-a32c-4b66-9a90-c1c2c20130b0","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-2fca4d.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-2fca4d","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-cd3648","namespace":"ai-tenant-e2e-shared-a-2fca4d","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-02T19:55:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"6557a8d9-a32c-4b66-9a90-c1c2c20130b0","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T19:55:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6557a8d9-a32c-4b66-9a90-c1c2c20130b0","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T19:55:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6557a8d9-a32c-4b66-9a90-c1c2c20130b0","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T19:55:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6557a8d9-a32c-4b66-9a90-c1c2c20130b0","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T19:55:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6557a8d9-a32c-4b66-9a90-c1c2c20130b0","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-2fca4d/rate-test-model-2fca4d\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T19:55:44Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6557a8d9-a32c-4b66-9a90-c1c2c20130b0","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-02T19:55:44Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6557a8d9-a32c-4b66-9a90-c1c2c20130b0","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-02T19:55:44Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6557a8d9-a32c-4b66-9a90-c1c2c20130b0","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-cd3648"}
{"level":"debug","ts":"2026-07-02T19:55:44Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6557a8d9-a32c-4b66-9a90-c1c2c20130b0","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"1252fcaa-ccc0-4bff-be28-48510103f86b","keyName":"e2e-rate-a-cd3648","selected_subscription":"e2e-rate-iso-a-cd3648","selected_subscription_key":"ai-tenant-e2e-shared-a-2fca4d/e2e-rate-iso-a-cd3648@ai-tenant-e2e-shared-a-2fca4d/rate-test-model-2fca4d","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-2fca4d","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-cd3648","namespace":"ai-tenant-e2e-shared-a-2fca4d","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-02T19:55:44Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6557a8d9-a32c-4b66-9a90-c1c2c20130b0","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T19:55:44Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6557a8d9-a32c-4b66-9a90-c1c2c20130b0","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T19:55:45Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"bb8a684f-9cad-9bc9-ae76-e076d07f0acf","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.11:57626","PortSpecifier":{"PortValue":57626}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"bb8a684f-9cad-9bc9-ae76-e076d07f0acf","method":"POST","path":"/ai-tenant-e2e-shared-a-2fca4d/rate-test-model-2fca4d/v1/completions","host":"e2e-shared-a-2fca4d.apps.f37af604-827d-4b1e-b2e7-a43ddf26f5c0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T19:55:45Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"bb8a684f-9cad-9bc9-ae76-e076d07f0acf","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.11:57626","PortSpecifier":{"PortValue":57626}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783022145,"nanos":321652584},"http":{"id":"bb8a684f-9cad-9bc9-ae76-e076d07f0acf","method":"POST","headers":{":authority":"e2e-shared-a-2fca4d.apps.f37af604-827d-4b1e-b2e7-a43ddf26f5c0.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-2fca4d/rate-test-model-2fca4d/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T19:55:45Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"bb8a684f-9cad-9bc9-ae76-e076d07f0acf","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-vDVRU7aTzX6tQ3r4_nqATQGcuRR2OkLBjUGFufj2bofY1oUbSxNQz1fh43VV"}
{"level":"debug","ts":"2026-07-02T19:55:45Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"bb8a684f-9cad-9bc9-ae76-e076d07f0acf","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-2fca4d.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-vDVRU7aTzX6tQ3r4_nqATQGcuRR2OkLBjUGFufj2bofY1oUbSxNQz1fh43VV\"}"}
{"level":"debug","ts":"2026-07-02T19:55:45Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"bb8a684f-9cad-9bc9-ae76-e076d07f0acf","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-2fca4d.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"1252fcaa-ccc0-4bff-be28-48510103f86b","keyName":"e2e-rate-a-cd3648","subscription":"e2e-rate-iso-a-cd3648","tenant":"e2e-shared-a-2fca4d","userId":"1252fcaa-ccc0-4bff-be28-48510103f86b","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-02T19:55:45Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"bb8a684f-9cad-9bc9-ae76-e076d07f0acf","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-2fca4d.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-2fca4d/rate-test-model-2fca4d\",\"requestedSubscription\":\"e2e-rate-iso-a-cd3648\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-02T19:55:45Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"bb8a684f-9cad-9bc9-ae76-e076d07f0acf","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-2fca4d.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-2fca4d","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-cd3648","namespace":"ai-tenant-e2e-shared-a-2fca4d","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-02T19:55:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"bb8a684f-9cad-9bc9-ae76-e076d07f0acf","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T19:55:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"bb8a684f-9cad-9bc9-ae76-e076d07f0acf","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T19:55:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"bb8a684f-9cad-9bc9-ae76-e076d07f0acf","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T19:55:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"bb8a684f-9cad-9bc9-ae76-e076d07f0acf","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-2fca4d/rate-test-model-2fca4d\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T19:55:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"bb8a684f-9cad-9bc9-ae76-e076d07f0acf","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T19:55:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"bb8a684f-9cad-9bc9-ae76-e076d07f0acf","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-02T19:55:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"bb8a684f-9cad-9bc9-ae76-e076d07f0acf","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-02T19:55:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"bb8a684f-9cad-9bc9-ae76-e076d07f0acf","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-cd3648"}
{"level":"debug","ts":"2026-07-02T19:55:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"bb8a684f-9cad-9bc9-ae76-e076d07f0acf","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"1252fcaa-ccc0-4bff-be28-48510103f86b","keyName":"e2e-rate-a-cd3648","selected_subscription":"e2e-rate-iso-a-cd3648","selected_subscription_key":"ai-tenant-e2e-shared-a-2fca4d/e2e-rate-iso-a-cd3648@ai-tenant-e2e-shared-a-2fca4d/rate-test-model-2fca4d","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-2fca4d","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-cd3648","namespace":"ai-tenant-e2e-shared-a-2fca4d","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-02T19:55:45Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"bb8a684f-9cad-9bc9-ae76-e076d07f0acf","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T19:55:45Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"bb8a684f-9cad-9bc9-ae76-e076d07f0acf","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T19:55:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2f69f300-7a8b-45f4-ae85-70234cbf757e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.11:57632","PortSpecifier":{"PortValue":57632}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"2f69f300-7a8b-45f4-ae85-70234cbf757e","method":"POST","path":"/ai-tenant-e2e-shared-a-2fca4d/rate-test-model-2fca4d/v1/completions","host":"e2e-shared-a-2fca4d.apps.f37af604-827d-4b1e-b2e7-a43ddf26f5c0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T19:55:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2f69f300-7a8b-45f4-ae85-70234cbf757e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.11:57632","PortSpecifier":{"PortValue":57632}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783022146,"nanos":362562601},"http":{"id":"2f69f300-7a8b-45f4-ae85-70234cbf757e","method":"POST","headers":{":authority":"e2e-shared-a-2fca4d.apps.f37af604-827d-4b1e-b2e7-a43ddf26f5c0.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-2fca4d/rate-test-model-2fca4d/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T19:55:46Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"2f69f300-7a8b-45f4-ae85-70234cbf757e","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-vDVRU7aTzX6tQ3r4_nqATQGcuRR2OkLBjUGFufj2bofY1oUbSxNQz1fh43VV"}
{"level":"debug","ts":"2026-07-02T19:55:46Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"2f69f300-7a8b-45f4-ae85-70234cbf757e","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-2fca4d.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-vDVRU7aTzX6tQ3r4_nqATQGcuRR2OkLBjUGFufj2bofY1oUbSxNQz1fh43VV\"}"}
{"level":"debug","ts":"2026-07-02T19:55:46Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"2f69f300-7a8b-45f4-ae85-70234cbf757e","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-2fca4d.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"1252fcaa-ccc0-4bff-be28-48510103f86b","keyName":"e2e-rate-a-cd3648","subscription":"e2e-rate-iso-a-cd3648","tenant":"e2e-shared-a-2fca4d","userId":"1252fcaa-ccc0-4bff-be28-48510103f86b","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-02T19:55:46Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"2f69f300-7a8b-45f4-ae85-70234cbf757e","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-2fca4d.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-2fca4d/rate-test-model-2fca4d\",\"requestedSubscription\":\"e2e-rate-iso-a-cd3648\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-02T19:55:46Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"2f69f300-7a8b-45f4-ae85-70234cbf757e","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-2fca4d.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-2fca4d","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-cd3648","namespace":"ai-tenant-e2e-shared-a-2fca4d","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-02T19:55:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"2f69f300-7a8b-45f4-ae85-70234cbf757e","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T19:55:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2f69f300-7a8b-45f4-ae85-70234cbf757e","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T19:55:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2f69f300-7a8b-45f4-ae85-70234cbf757e","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T19:55:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2f69f300-7a8b-45f4-ae85-70234cbf757e","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T19:55:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2f69f300-7a8b-45f4-ae85-70234cbf757e","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-2fca4d/rate-test-model-2fca4d\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T19:55:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2f69f300-7a8b-45f4-ae85-70234cbf757e","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-02T19:55:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2f69f300-7a8b-45f4-ae85-70234cbf757e","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-cd3648"}
{"level":"debug","ts":"2026-07-02T19:55:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2f69f300-7a8b-45f4-ae85-70234cbf757e","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-02T19:55:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2f69f300-7a8b-45f4-ae85-70234cbf757e","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"1252fcaa-ccc0-4bff-be28-48510103f86b","keyName":"e2e-rate-a-cd3648","selected_subscription":"e2e-rate-iso-a-cd3648","selected_subscription_key":"ai-tenant-e2e-shared-a-2fca4d/e2e-rate-iso-a-cd3648@ai-tenant-e2e-shared-a-2fca4d/rate-test-model-2fca4d","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-2fca4d","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-cd3648","namespace":"ai-tenant-e2e-shared-a-2fca4d","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-02T19:55:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2f69f300-7a8b-45f4-ae85-70234cbf757e","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T19:55:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2f69f300-7a8b-45f4-ae85-70234cbf757e","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T19:55:47Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8582377f-a542-4aa6-9380-077dc1992a1a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.11:57640","PortSpecifier":{"PortValue":57640}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"8582377f-a542-4aa6-9380-077dc1992a1a","method":"POST","path":"/ai-tenant-e2e-shared-a-2fca4d/rate-test-model-2fca4d/v1/completions","host":"e2e-shared-a-2fca4d.apps.f37af604-827d-4b1e-b2e7-a43ddf26f5c0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T19:55:47Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8582377f-a542-4aa6-9380-077dc1992a1a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.11:57640","PortSpecifier":{"PortValue":57640}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783022147,"nanos":402185304},"http":{"id":"8582377f-a542-4aa6-9380-077dc1992a1a","method":"POST","headers":{":authority":"e2e-shared-a-2fca4d.apps.f37af604-827d-4b1e-b2e7-a43ddf26f5c0.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-2fca4d/rate-test-model-2fca4d/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T19:55:47Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"8582377f-a542-4aa6-9380-077dc1992a1a","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-vDVRU7aTzX6tQ3r4_nqATQGcuRR2OkLBjUGFufj2bofY1oUbSxNQz1fh43VV"}
{"level":"debug","ts":"2026-07-02T19:55:47Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"8582377f-a542-4aa6-9380-077dc1992a1a","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-2fca4d.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-vDVRU7aTzX6tQ3r4_nqATQGcuRR2OkLBjUGFufj2bofY1oUbSxNQz1fh43VV\"}"}
{"level":"debug","ts":"2026-07-02T19:55:47Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"8582377f-a542-4aa6-9380-077dc1992a1a","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-2fca4d.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"1252fcaa-ccc0-4bff-be28-48510103f86b","keyName":"e2e-rate-a-cd3648","subscription":"e2e-rate-iso-a-cd3648","tenant":"e2e-shared-a-2fca4d","userId":"1252fcaa-ccc0-4bff-be28-48510103f86b","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-02T19:55:47Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"8582377f-a542-4aa6-9380-077dc1992a1a","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-2fca4d.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-2fca4d/rate-test-model-2fca4d\",\"requestedSubscription\":\"e2e-rate-iso-a-cd3648\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-02T19:55:47Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"8582377f-a542-4aa6-9380-077dc1992a1a","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-2fca4d.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-2fca4d","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-cd3648","namespace":"ai-tenant-e2e-shared-a-2fca4d","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-02T19:55:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"8582377f-a542-4aa6-9380-077dc1992a1a","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T19:55:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8582377f-a542-4aa6-9380-077dc1992a1a","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T19:55:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8582377f-a542-4aa6-9380-077dc1992a1a","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T19:55:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8582377f-a542-4aa6-9380-077dc1992a1a","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T19:55:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8582377f-a542-4aa6-9380-077dc1992a1a","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-2fca4d/rate-test-model-2fca4d\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T19:55:47Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8582377f-a542-4aa6-9380-077dc1992a1a","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-02T19:55:47Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8582377f-a542-4aa6-9380-077dc1992a1a","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-cd3648"}
{"level":"debug","ts":"2026-07-02T19:55:47Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8582377f-a542-4aa6-9380-077dc1992a1a","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-02T19:55:47Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8582377f-a542-4aa6-9380-077dc1992a1a","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"1252fcaa-ccc0-4bff-be28-48510103f86b","keyName":"e2e-rate-a-cd3648","selected_subscription":"e2e-rate-iso-a-cd3648","selected_subscription_key":"ai-tenant-e2e-shared-a-2fca4d/e2e-rate-iso-a-cd3648@ai-tenant-e2e-shared-a-2fca4d/rate-test-model-2fca4d","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-2fca4d","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-cd3648","namespace":"ai-tenant-e2e-shared-a-2fca4d","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-02T19:55:47Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8582377f-a542-4aa6-9380-077dc1992a1a","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T19:55:47Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8582377f-a542-4aa6-9380-077dc1992a1a","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T19:55:48Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"79184134-1f1a-42ce-ba7a-e1f02357207c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.11:57656","PortSpecifier":{"PortValue":57656}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"79184134-1f1a-42ce-ba7a-e1f02357207c","method":"POST","path":"/ai-tenant-e2e-shared-a-2fca4d/rate-test-model-2fca4d/v1/completions","host":"e2e-shared-a-2fca4d.apps.f37af604-827d-4b1e-b2e7-a43ddf26f5c0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T19:55:48Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"79184134-1f1a-42ce-ba7a-e1f02357207c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.11:57656","PortSpecifier":{"PortValue":57656}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783022148,"nanos":442267158},"http":{"id":"79184134-1f1a-42ce-ba7a-e1f02357207c","method":"POST","headers":{":authority":"e2e-shared-a-2fca4d.apps.f37af604-827d-4b1e-b2e7-a43ddf26f5c0.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-2fca4d/rate-test-model-2fca4d/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T19:55:48Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"79184134-1f1a-42ce-ba7a-e1f02357207c","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-vDVRU7aTzX6tQ3r4_nqATQGcuRR2OkLBjUGFufj2bofY1oUbSxNQz1fh43VV"}
{"level":"debug","ts":"2026-07-02T19:55:48Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"79184134-1f1a-42ce-ba7a-e1f02357207c","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-2fca4d.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-vDVRU7aTzX6tQ3r4_nqATQGcuRR2OkLBjUGFufj2bofY1oUbSxNQz1fh43VV\"}"}
{"level":"debug","ts":"2026-07-02T19:55:48Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"79184134-1f1a-42ce-ba7a-e1f02357207c","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-2fca4d.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"1252fcaa-ccc0-4bff-be28-48510103f86b","keyName":"e2e-rate-a-cd3648","subscription":"e2e-rate-iso-a-cd3648","tenant":"e2e-shared-a-2fca4d","userId":"1252fcaa-ccc0-4bff-be28-48510103f86b","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-02T19:55:48Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"79184134-1f1a-42ce-ba7a-e1f02357207c","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-2fca4d.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-2fca4d/rate-test-model-2fca4d\",\"requestedSubscription\":\"e2e-rate-iso-a-cd3648\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-02T19:55:48Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"79184134-1f1a-42ce-ba7a-e1f02357207c","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-2fca4d.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-2fca4d","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-cd3648","namespace":"ai-tenant-e2e-shared-a-2fca4d","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-02T19:55:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"79184134-1f1a-42ce-ba7a-e1f02357207c","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T19:55:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"79184134-1f1a-42ce-ba7a-e1f02357207c","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T19:55:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"79184134-1f1a-42ce-ba7a-e1f02357207c","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T19:55:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"79184134-1f1a-42ce-ba7a-e1f02357207c","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T19:55:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"79184134-1f1a-42ce-ba7a-e1f02357207c","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-2fca4d/rate-test-model-2fca4d\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T19:55:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"79184134-1f1a-42ce-ba7a-e1f02357207c","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-cd3648"}
{"level":"debug","ts":"2026-07-02T19:55:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"79184134-1f1a-42ce-ba7a-e1f02357207c","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-02T19:55:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"79184134-1f1a-42ce-ba7a-e1f02357207c","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-02T19:55:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"79184134-1f1a-42ce-ba7a-e1f02357207c","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"1252fcaa-ccc0-4bff-be28-48510103f86b","keyName":"e2e-rate-a-cd3648","selected_subscription":"e2e-rate-iso-a-cd3648","selected_subscription_key":"ai-tenant-e2e-shared-a-2fca4d/e2e-rate-iso-a-cd3648@ai-tenant-e2e-shared-a-2fca4d/rate-test-model-2fca4d","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-2fca4d","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-cd3648","namespace":"ai-tenant-e2e-shared-a-2fca4d","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-02T19:55:48Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"79184134-1f1a-42ce-ba7a-e1f02357207c","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T19:55:48Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"79184134-1f1a-42ce-ba7a-e1f02357207c","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T19:55:49Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2e568790-77f1-4744-b38a-b0890089043a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.11:57662","PortSpecifier":{"PortValue":57662}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"2e568790-77f1-4744-b38a-b0890089043a","method":"POST","path":"/ai-tenant-e2e-shared-a-2fca4d/rate-test-model-2fca4d/v1/completions","host":"e2e-shared-a-2fca4d.apps.f37af604-827d-4b1e-b2e7-a43ddf26f5c0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T19:55:49Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2e568790-77f1-4744-b38a-b0890089043a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.11:57662","PortSpecifier":{"PortValue":57662}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783022149,"nanos":478284837},"http":{"id":"2e568790-77f1-4744-b38a-b0890089043a","method":"POST","headers":{":authority":"e2e-shared-a-2fca4d.apps.f37af604-827d-4b1e-b2e7-a43ddf26f5c0.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-2fca4d/rate-test-model-2fca4d/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T19:55:49Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"2e568790-77f1-4744-b38a-b0890089043a","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-vDVRU7aTzX6tQ3r4_nqATQGcuRR2OkLBjUGFufj2bofY1oUbSxNQz1fh43VV"}
{"level":"debug","ts":"2026-07-02T19:55:49Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"2e568790-77f1-4744-b38a-b0890089043a","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-2fca4d.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-vDVRU7aTzX6tQ3r4_nqATQGcuRR2OkLBjUGFufj2bofY1oUbSxNQz1fh43VV\"}"}
{"level":"debug","ts":"2026-07-02T19:55:49Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"2e568790-77f1-4744-b38a-b0890089043a","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-2fca4d.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"1252fcaa-ccc0-4bff-be28-48510103f86b","keyName":"e2e-rate-a-cd3648","subscription":"e2e-rate-iso-a-cd3648","tenant":"e2e-shared-a-2fca4d","userId":"1252fcaa-ccc0-4bff-be28-48510103f86b","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-02T19:55:49Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"2e568790-77f1-4744-b38a-b0890089043a","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-2fca4d.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-2fca4d/rate-test-model-2fca4d\",\"requestedSubscription\":\"e2e-rate-iso-a-cd3648\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-02T19:55:49Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"2e568790-77f1-4744-b38a-b0890089043a","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-2fca4d.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-2fca4d","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-cd3648","namespace":"ai-tenant-e2e-shared-a-2fca4d","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-02T19:55:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"2e568790-77f1-4744-b38a-b0890089043a","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T19:55:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2e568790-77f1-4744-b38a-b0890089043a","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T19:55:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2e568790-77f1-4744-b38a-b0890089043a","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T19:55:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2e568790-77f1-4744-b38a-b0890089043a","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T19:55:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2e568790-77f1-4744-b38a-b0890089043a","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-2fca4d/rate-test-model-2fca4d\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T19:55:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2e568790-77f1-4744-b38a-b0890089043a","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-02T19:55:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2e568790-77f1-4744-b38a-b0890089043a","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-02T19:55:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2e568790-77f1-4744-b38a-b0890089043a","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-cd3648"}
{"level":"debug","ts":"2026-07-02T19:55:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2e568790-77f1-4744-b38a-b0890089043a","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"1252fcaa-ccc0-4bff-be28-48510103f86b","keyName":"e2e-rate-a-cd3648","selected_subscription":"e2e-rate-iso-a-cd3648","selected_subscription_key":"ai-tenant-e2e-shared-a-2fca4d/e2e-rate-iso-a-cd3648@ai-tenant-e2e-shared-a-2fca4d/rate-test-model-2fca4d","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-2fca4d","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-cd3648","namespace":"ai-tenant-e2e-shared-a-2fca4d","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-02T19:55:49Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2e568790-77f1-4744-b38a-b0890089043a","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T19:55:49Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2e568790-77f1-4744-b38a-b0890089043a","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T19:55:50Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"4d30db27-c3a9-4041-99d3-1bb21e2ae66d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.11:36694","PortSpecifier":{"PortValue":36694}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"4d30db27-c3a9-4041-99d3-1bb21e2ae66d","method":"POST","path":"/ai-tenant-e2e-shared-a-2fca4d/rate-test-model-2fca4d/v1/completions","host":"e2e-shared-a-2fca4d.apps.f37af604-827d-4b1e-b2e7-a43ddf26f5c0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T19:55:50Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"4d30db27-c3a9-4041-99d3-1bb21e2ae66d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.11:36694","PortSpecifier":{"PortValue":36694}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783022150,"nanos":516680335},"http":{"id":"4d30db27-c3a9-4041-99d3-1bb21e2ae66d","method":"POST","headers":{":authority":"e2e-shared-a-2fca4d.apps.f37af604-827d-4b1e-b2e7-a43ddf26f5c0.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-2fca4d/rate-test-model-2fca4d/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T19:55:50Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"4d30db27-c3a9-4041-99d3-1bb21e2ae66d","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-vDVRU7aTzX6tQ3r4_nqATQGcuRR2OkLBjUGFufj2bofY1oUbSxNQz1fh43VV"}
{"level":"debug","ts":"2026-07-02T19:55:50Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"4d30db27-c3a9-4041-99d3-1bb21e2ae66d","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-2fca4d.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-vDVRU7aTzX6tQ3r4_nqATQGcuRR2OkLBjUGFufj2bofY1oUbSxNQz1fh43VV\"}"}
{"level":"debug","ts":"2026-07-02T19:55:50Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"4d30db27-c3a9-4041-99d3-1bb21e2ae66d","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-2fca4d.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"1252fcaa-ccc0-4bff-be28-48510103f86b","keyName":"e2e-rate-a-cd3648","subscription":"e2e-rate-iso-a-cd3648","tenant":"e2e-shared-a-2fca4d","userId":"1252fcaa-ccc0-4bff-be28-48510103f86b","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-02T19:55:50Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"4d30db27-c3a9-4041-99d3-1bb21e2ae66d","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-2fca4d.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-2fca4d/rate-test-model-2fca4d\",\"requestedSubscription\":\"e2e-rate-iso-a-cd3648\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-02T19:55:50Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"4d30db27-c3a9-4041-99d3-1bb21e2ae66d","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-2fca4d.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-2fca4d","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-cd3648","namespace":"ai-tenant-e2e-shared-a-2fca4d","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-02T19:55:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"4d30db27-c3a9-4041-99d3-1bb21e2ae66d","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T19:55:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4d30db27-c3a9-4041-99d3-1bb21e2ae66d","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T19:55:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4d30db27-c3a9-4041-99d3-1bb21e2ae66d","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T19:55:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4d30db27-c3a9-4041-99d3-1bb21e2ae66d","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-2fca4d/rate-test-model-2fca4d\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T19:55:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4d30db27-c3a9-4041-99d3-1bb21e2ae66d","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T19:55:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4d30db27-c3a9-4041-99d3-1bb21e2ae66d","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-02T19:55:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4d30db27-c3a9-4041-99d3-1bb21e2ae66d","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-cd3648"}
{"level":"debug","ts":"2026-07-02T19:55:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4d30db27-c3a9-4041-99d3-1bb21e2ae66d","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-02T19:55:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4d30db27-c3a9-4041-99d3-1bb21e2ae66d","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"1252fcaa-ccc0-4bff-be28-48510103f86b","keyName":"e2e-rate-a-cd3648","selected_subscription":"e2e-rate-iso-a-cd3648","selected_subscription_key":"ai-tenant-e2e-shared-a-2fca4d/e2e-rate-iso-a-cd3648@ai-tenant-e2e-shared-a-2fca4d/rate-test-model-2fca4d","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-2fca4d","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-cd3648","namespace":"ai-tenant-e2e-shared-a-2fca4d","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-02T19:55:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4d30db27-c3a9-4041-99d3-1bb21e2ae66d","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T19:55:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4d30db27-c3a9-4041-99d3-1bb21e2ae66d","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T19:55:51Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"75ee31c5-549d-41ef-a3dc-385259bc366d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.11:36698","PortSpecifier":{"PortValue":36698}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"75ee31c5-549d-41ef-a3dc-385259bc366d","method":"POST","path":"/ai-tenant-e2e-shared-a-2fca4d/rate-test-model-2fca4d/v1/completions","host":"e2e-shared-a-2fca4d.apps.f37af604-827d-4b1e-b2e7-a43ddf26f5c0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T19:55:51Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"75ee31c5-549d-41ef-a3dc-385259bc366d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.11:36698","PortSpecifier":{"PortValue":36698}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783022151,"nanos":553757666},"http":{"id":"75ee31c5-549d-41ef-a3dc-385259bc366d","method":"POST","headers":{":authority":"e2e-shared-a-2fca4d.apps.f37af604-827d-4b1e-b2e7-a43ddf26f5c0.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-2fca4d/rate-test-model-2fca4d/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T19:55:51Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"75ee31c5-549d-41ef-a3dc-385259bc366d","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-vDVRU7aTzX6tQ3r4_nqATQGcuRR2OkLBjUGFufj2bofY1oUbSxNQz1fh43VV"}
{"level":"debug","ts":"2026-07-02T19:55:51Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"75ee31c5-549d-41ef-a3dc-385259bc366d","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-2fca4d.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-vDVRU7aTzX6tQ3r4_nqATQGcuRR2OkLBjUGFufj2bofY1oUbSxNQz1fh43VV\"}"}
{"level":"debug","ts":"2026-07-02T19:55:51Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"75ee31c5-549d-41ef-a3dc-385259bc366d","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-2fca4d.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"1252fcaa-ccc0-4bff-be28-48510103f86b","keyName":"e2e-rate-a-cd3648","subscription":"e2e-rate-iso-a-cd3648","tenant":"e2e-shared-a-2fca4d","userId":"1252fcaa-ccc0-4bff-be28-48510103f86b","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-02T19:55:51Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"75ee31c5-549d-41ef-a3dc-385259bc366d","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-2fca4d.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-2fca4d/rate-test-model-2fca4d\",\"requestedSubscription\":\"e2e-rate-iso-a-cd3648\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-02T19:55:51Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"75ee31c5-549d-41ef-a3dc-385259bc366d","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-2fca4d.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-2fca4d","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-cd3648","namespace":"ai-tenant-e2e-shared-a-2fca4d","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-02T19:55:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"75ee31c5-549d-41ef-a3dc-385259bc366d","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T19:55:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"75ee31c5-549d-41ef-a3dc-385259bc366d","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T19:55:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"75ee31c5-549d-41ef-a3dc-385259bc366d","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T19:55:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"75ee31c5-549d-41ef-a3dc-385259bc366d","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T19:55:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"75ee31c5-549d-41ef-a3dc-385259bc366d","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-2fca4d/rate-test-model-2fca4d\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T19:55:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"75ee31c5-549d-41ef-a3dc-385259bc366d","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-02T19:55:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"75ee31c5-549d-41ef-a3dc-385259bc366d","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-02T19:55:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"75ee31c5-549d-41ef-a3dc-385259bc366d","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-cd3648"}
{"level":"debug","ts":"2026-07-02T19:55:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"75ee31c5-549d-41ef-a3dc-385259bc366d","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"1252fcaa-ccc0-4bff-be28-48510103f86b","keyName":"e2e-rate-a-cd3648","selected_subscription":"e2e-rate-iso-a-cd3648","selected_subscription_key":"ai-tenant-e2e-shared-a-2fca4d/e2e-rate-iso-a-cd3648@ai-tenant-e2e-shared-a-2fca4d/rate-test-model-2fca4d","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-2fca4d","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-cd3648","namespace":"ai-tenant-e2e-shared-a-2fca4d","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-02T19:55:51Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"75ee31c5-549d-41ef-a3dc-385259bc366d","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T19:55:51Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"75ee31c5-549d-41ef-a3dc-385259bc366d","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T19:55:52Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ec2e9a72-97ed-4561-b404-4a8686e3f300","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.11:36714","PortSpecifier":{"PortValue":36714}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"ec2e9a72-97ed-4561-b404-4a8686e3f300","method":"POST","path":"/ai-tenant-e2e-shared-a-2fca4d/rate-test-model-2fca4d/v1/completions","host":"e2e-shared-a-2fca4d.apps.f37af604-827d-4b1e-b2e7-a43ddf26f5c0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T19:55:52Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ec2e9a72-97ed-4561-b404-4a8686e3f300","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.11:36714","PortSpecifier":{"PortValue":36714}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.44:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783022152,"nanos":591042231},"http":{"id":"ec2e9a72-97ed-4561-b404-4a8686e3f300","method":"POST","headers":{":authority":"e2e-shared-a-2fca4d.apps.f37af604-827d-4b1e-b2e7-a43ddf26f5c0.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-2fca4d/rate-test-model-2fca4d/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T19:55:52Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"ec2e9a72-97ed-4561-b404-4a8686e3f300","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-vDVRU7aTzX6tQ3r4_nqATQGcuRR2OkLBjUGFufj2bofY1oUbSxNQz1fh43VV"}
{"level":"debug","ts":"2026-07-02T19:55:52Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"ec2e9a72-97ed-4561-b404-4a8686e3f300","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-2fca4d.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-vDVRU7aTzX6tQ3r4_nqATQGcuRR2OkLBjUGFufj2bofY1oUbSxNQz1fh43VV\"}"}
{"level":"debug","ts":"2026-07-02T19:55:52Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"ec2e9a72-97ed-4561-b404-4a8686e3f300","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-2fca4d.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"1252fcaa-ccc0-4bff-be28-48510103f86b","keyName":"e2e-rate-a-cd3648","subscription":"e2e-rate-iso-a-cd3648","tenant":"e2e-shared-a-2fca4d","userId":"1252fcaa-ccc0-4bff-be28-48510103f86b","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-02T19:55:52Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"ec2e9a72-97ed-4561-b404-4a8686e3f300","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-2fca4d.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-2fca4d/rate-test-model-2fca4d\",\"requestedSubscription\":\"e2e-rate-iso-a-cd3648\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-02T19:55:52Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"ec2e9a72-97ed-4561-b404-4a8686e3f300","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-2fca4d.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-2fca4d","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-cd3648","namespace":"ai-tenant-e2e-shared-a-2fca4d","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-02T19:55:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"ec2e9a72-97ed-4561-b404-4a8686e3f300","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T19:55:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ec2e9a72-97ed-4561-b404-4a8686e3f300","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T19:55:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ec2e9a72-97ed-4561-b404-4a8686e3f300","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T19:55:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ec2e9a72-97ed-4561-b404-4a8686e3f300","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T19:55:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ec2e9a72-97ed-4561-b404-4a8686e3f300","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-2fca4d/rate-test-model-2fca4d\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T19:55:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ec2e9a72-97ed-4561-b404-4a8686e3f300","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-cd3648"}
{"level":"debug","ts":"2026-07-02T19:55:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ec2e9a72-97ed-4561-b404-4a8686e3f300","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-02T19:55:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ec2e9a72-97ed-4561-b404-4a8686e3f300","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-02T19:55:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ec2e9a72-97ed-4561-b404-4a8686e3f300","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"1252fcaa-ccc0-4bff-be28-48510103f86b","keyName":"e2e-rate-a-cd3648","selected_subscription":"e2e-rate-iso-a-cd3648","selected_subscription_key":"ai-tenant-e2e-shared-a-2fca4d/e2e-rate-iso-a-cd3648@ai-tenant-e2e-shared-a-2fca4d/rate-test-model-2fca4d","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-2fca4d","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-cd3648","namespace":"ai-tenant-e2e-shared-a-2fca4d","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-02T19:55:52Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ec2e9a72-97ed-4561-b404-4a8686e3f300","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T19:55:52Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ec2e9a72-97ed-4561-b404-4a8686e3f300","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T19:55:52Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d0feecb7-b010-4041-a61e-2d15cc401cdc","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.11:46406","PortSpecifier":{"PortValue":46406}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.46:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"d0feecb7-b010-4041-a61e-2d15cc401cdc","method":"POST","path":"/ai-tenant-e2e-shared-b-f9d728/rate-test-model-f9d728/v1/completions","host":"e2e-shared-b-f9d728.apps.f37af604-827d-4b1e-b2e7-a43ddf26f5c0.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-02T19:55:52Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d0feecb7-b010-4041-a61e-2d15cc401cdc","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.11:46406","PortSpecifier":{"PortValue":46406}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.46:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783022152,"nanos":629625094},"http":{"id":"d0feecb7-b010-4041-a61e-2d15cc401cdc","method":"POST","headers":{":authority":"e2e-shared-b-f9d728.apps.f37af604-827d-4b1e-b2e7-a43ddf26f5c0.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-b-f9d728/rate-test-model-f9d728/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T19:55:52Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"d0feecb7-b010-4041-a61e-2d15cc401cdc","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-mT30WJBLKKbDoiwj_mRSHyZ4i1yPkNH4bLZnb1saRG3gfFhuEovRwzg13UQM"}
{"level":"debug","ts":"2026-07-02T19:55:52Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"d0feecb7-b010-4041-a61e-2d15cc401cdc","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-b-f9d728.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-mT30WJBLKKbDoiwj_mRSHyZ4i1yPkNH4bLZnb1saRG3gfFhuEovRwzg13UQM\"}"}
{"level":"debug","ts":"2026-07-02T19:55:52Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"d0feecb7-b010-4041-a61e-2d15cc401cdc","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-f9d728.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"88207aca-e71d-4e81-ba96-c27bf7c2bcd5","keyName":"e2e-rate-b-cd3648","subscription":"e2e-rate-iso-b-cd3648","tenant":"e2e-shared-b-f9d728","userId":"88207aca-e71d-4e81-ba96-c27bf7c2bcd5","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-02T19:55:52Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"d0feecb7-b010-4041-a61e-2d15cc401cdc","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-b-f9d728.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-b-f9d728/rate-test-model-f9d728\",\"requestedSubscription\":\"e2e-rate-iso-b-cd3648\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-02T19:55:52Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"d0feecb7-b010-4041-a61e-2d15cc401cdc","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-f9d728.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-f9d728","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-cd3648","namespace":"ai-tenant-e2e-shared-b-f9d728","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-02T19:55:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"d0feecb7-b010-4041-a61e-2d15cc401cdc","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-02T19:55:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d0feecb7-b010-4041-a61e-2d15cc401cdc","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T19:55:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d0feecb7-b010-4041-a61e-2d15cc401cdc","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T19:55:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d0feecb7-b010-4041-a61e-2d15cc401cdc","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T19:55:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d0feecb7-b010-4041-a61e-2d15cc401cdc","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-f9d728/rate-test-model-f9d728\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-02T19:55:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d0feecb7-b010-4041-a61e-2d15cc401cdc","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-02T19:55:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d0feecb7-b010-4041-a61e-2d15cc401cdc","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-b-cd3648"}
{"level":"debug","ts":"2026-07-02T19:55:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d0feecb7-b010-4041-a61e-2d15cc401cdc","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-02T19:55:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d0feecb7-b010-4041-a61e-2d15cc401cdc","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"88207aca-e71d-4e81-ba96-c27bf7c2bcd5","keyName":"e2e-rate-b-cd3648","selected_subscription":"e2e-rate-iso-b-cd3648","selected_subscription_key":"ai-tenant-e2e-shared-b-f9d728/e2e-rate-iso-b-cd3648@ai-tenant-e2e-shared-b-f9d728/rate-test-model-f9d728","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-f9d728","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-cd3648","namespace":"ai-tenant-e2e-shared-b-f9d728","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-02T19:55:52Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d0feecb7-b010-4041-a61e-2d15cc401cdc","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-02T19:55:52Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d0feecb7-b010-4041-a61e-2d15cc401cdc","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-02T19:55:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/5bee434e3fb4c810be941e79afd04e7dbaee2f5195449cc7c0c0c358c2e68ea1"}
{"level":"info","ts":"2026-07-02T19:55:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/9d17cc73f0a37e8116def3b6a5a1c5072c2f0ee6575d0f90891c708d29be8ddd"}
{"level":"info","ts":"2026-07-02T19:55:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/850534fa0cdbb991bfb075008d3225736952c988937168c31d24c62f51ce43b3"}
{"level":"info","ts":"2026-07-02T19:55:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/c12297ed5d610842fbdc3a8db846ea6fc7a2850cf4e227c7fba355a8f7891d78"}
{"level":"info","ts":"2026-07-02T19:55:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/71a1eb8a6f1d34ffb8de608759ef0a698162fb6985064a3e3484849c721bad6a"}
{"level":"info","ts":"2026-07-02T19:55:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/28bef88d32f2cd20b5010f450b5a34f7c27b94d332e4cf61cf41d73157d195a4"}
{"level":"info","ts":"2026-07-02T19:55:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/21203a2b1d9dd6b10ed90520f7b45e8e896fed96c318c1d69be590568f896fc4"}
{"level":"info","ts":"2026-07-02T19:55:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/4d1ebcf330c3033aeae7ddf320ff9d9e3b36d481a05cb004790d88f496b86f65"}
{"level":"info","ts":"2026-07-02T19:55:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/7403e9577842df610c24958c550c0fe966eb94e2ebe3883f1550e011b2f4217d"}
{"level":"info","ts":"2026-07-02T19:55:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/6c6cd617b6ed1a799a035f3cbf3949bd120c307dff8a0d3097073f86022d221d"}
{"level":"info","ts":"2026-07-02T19:55:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/b5bda487471bfce70869c69093b8009a469502e2d629bb4845ee0731e518c59b"}
{"level":"info","ts":"2026-07-02T19:55:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/caa12846d6c7a46b153067b92cc28abbbe30621e60acec1a86f3d6b9b9e8ba43"}
{"level":"info","ts":"2026-07-02T19:55:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/524e482e9b350cd4a5920d8a8e171b6fc0a8d474aac0c8cc61fe4caa546ff0c5"}
{"level":"info","ts":"2026-07-02T19:55:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/61e3a6c3539ef45ffa4da6485c1bb6565794d8972e2f338e524c03c0bb536933"}
{"level":"info","ts":"2026-07-02T19:55:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/bf07081b2f04f8e2498a6b067ead17b921dbb2092c0347ea564afbca68bfbad4"}
{"level":"info","ts":"2026-07-02T19:55:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/2c687b9cbfd095dffaab243dc13bfb681ae35c372d4b4d7e6fc20d080b272c97"}
{"level":"info","ts":"2026-07-02T19:56:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/a7bc781ee50a080e4b1837e6233657e1f6945b0ab3c1212b87a35a342dd4b376"}
{"level":"info","ts":"2026-07-02T19:56:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/5373979ea596dbbc9247fb4c839f56cf020e689865c889156df7a87908999737"}
{"level":"info","ts":"2026-07-02T19:56:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/a66bfc1423e1fc9a805cf4b32d17a0741138eb4e48024d53a7167d597d09a41e"}
{"level":"info","ts":"2026-07-02T19:56:36Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/e9c3ec971c613f21f6413aaaac21d1f364df0a50e85ec0a52545937d445f9eac"}