{"level":"info","ts":"2026-07-24T00:57:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"769f6f0a-e1f2-403e-aff1-a5b193ac9a37","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.10:39076","PortSpecifier":{"PortValue":39076}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.65:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"769f6f0a-e1f2-403e-aff1-a5b193ac9a37","method":"POST","path":"/ai-tenant-e2e-shared-a-38da25/rate-test-model-38da25/v1/completions","host":"e2e-shared-a-38da25.apps.08e98f4e-5bc6-4a15-8c99-991d7235bd49.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T00:57:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"769f6f0a-e1f2-403e-aff1-a5b193ac9a37","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.10:39076","PortSpecifier":{"PortValue":39076}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.65:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784854656,"nanos":263919257},"http":{"id":"769f6f0a-e1f2-403e-aff1-a5b193ac9a37","method":"POST","headers":{":authority":"e2e-shared-a-38da25.apps.08e98f4e-5bc6-4a15-8c99-991d7235bd49.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-38da25/rate-test-model-38da25/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T00:57:36Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"769f6f0a-e1f2-403e-aff1-a5b193ac9a37","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1G0Os0hgqhIgscNVu_CWyYMWL2mYPIxWUYnilQhP8UU9KLzmUqGt9wqVoBMFx"}
{"level":"debug","ts":"2026-07-24T00:57:36Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"769f6f0a-e1f2-403e-aff1-a5b193ac9a37","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-38da25.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1G0Os0hgqhIgscNVu_CWyYMWL2mYPIxWUYnilQhP8UU9KLzmUqGt9wqVoBMFx\"}"}
{"level":"debug","ts":"2026-07-24T00:57:36Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"769f6f0a-e1f2-403e-aff1-a5b193ac9a37","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-38da25.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"dd4f1042-f48a-44a9-877c-a16e0ea41254","keyName":"e2e-rate-a-2d1c5e","subscription":"e2e-rate-iso-a-2d1c5e","tenant":"e2e-shared-a-38da25","userId":"dd4f1042-f48a-44a9-877c-a16e0ea41254","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-24T00:57:36Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"769f6f0a-e1f2-403e-aff1-a5b193ac9a37","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-38da25.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-38da25/rate-test-model-38da25\",\"requestedSubscription\":\"e2e-rate-iso-a-2d1c5e\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-24T00:57:36Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"769f6f0a-e1f2-403e-aff1-a5b193ac9a37","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-38da25.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-38da25","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-2d1c5e","namespace":"ai-tenant-e2e-shared-a-38da25","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-38da25/rate-test-model-38da25"}}
{"level":"debug","ts":"2026-07-24T00:57:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"769f6f0a-e1f2-403e-aff1-a5b193ac9a37","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T00:57:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"769f6f0a-e1f2-403e-aff1-a5b193ac9a37","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T00:57:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"769f6f0a-e1f2-403e-aff1-a5b193ac9a37","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T00:57:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"769f6f0a-e1f2-403e-aff1-a5b193ac9a37","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-38da25/rate-test-model-38da25\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-38da25/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T00:57:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"769f6f0a-e1f2-403e-aff1-a5b193ac9a37","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T00:57:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"769f6f0a-e1f2-403e-aff1-a5b193ac9a37","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-2d1c5e"}
{"level":"debug","ts":"2026-07-24T00:57:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"769f6f0a-e1f2-403e-aff1-a5b193ac9a37","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-24T00:57:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"769f6f0a-e1f2-403e-aff1-a5b193ac9a37","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T00:57:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"769f6f0a-e1f2-403e-aff1-a5b193ac9a37","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"dd4f1042-f48a-44a9-877c-a16e0ea41254","keyName":"e2e-rate-a-2d1c5e","selected_subscription":"e2e-rate-iso-a-2d1c5e","selected_subscription_key":"ai-tenant-e2e-shared-a-38da25/e2e-rate-iso-a-2d1c5e@ai-tenant-e2e-shared-a-38da25/rate-test-model-38da25","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-38da25","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-2d1c5e","namespace":"ai-tenant-e2e-shared-a-38da25","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-38da25/rate-test-model-38da25"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-24T00:57:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"769f6f0a-e1f2-403e-aff1-a5b193ac9a37","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T00:57:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"769f6f0a-e1f2-403e-aff1-a5b193ac9a37","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T00:57:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"65b0127b-5614-4191-a2af-f3e659fa6c02","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.10:39092","PortSpecifier":{"PortValue":39092}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.65:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"65b0127b-5614-4191-a2af-f3e659fa6c02","method":"POST","path":"/ai-tenant-e2e-shared-a-38da25/rate-test-model-38da25/v1/completions","host":"e2e-shared-a-38da25.apps.08e98f4e-5bc6-4a15-8c99-991d7235bd49.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T00:57:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"65b0127b-5614-4191-a2af-f3e659fa6c02","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.10:39092","PortSpecifier":{"PortValue":39092}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.65:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784854657,"nanos":356149954},"http":{"id":"65b0127b-5614-4191-a2af-f3e659fa6c02","method":"POST","headers":{":authority":"e2e-shared-a-38da25.apps.08e98f4e-5bc6-4a15-8c99-991d7235bd49.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-38da25/rate-test-model-38da25/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T00:57:37Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"65b0127b-5614-4191-a2af-f3e659fa6c02","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1G0Os0hgqhIgscNVu_CWyYMWL2mYPIxWUYnilQhP8UU9KLzmUqGt9wqVoBMFx"}
{"level":"debug","ts":"2026-07-24T00:57:37Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"65b0127b-5614-4191-a2af-f3e659fa6c02","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-38da25.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1G0Os0hgqhIgscNVu_CWyYMWL2mYPIxWUYnilQhP8UU9KLzmUqGt9wqVoBMFx\"}"}
{"level":"debug","ts":"2026-07-24T00:57:37Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"65b0127b-5614-4191-a2af-f3e659fa6c02","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-38da25.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"dd4f1042-f48a-44a9-877c-a16e0ea41254","keyName":"e2e-rate-a-2d1c5e","subscription":"e2e-rate-iso-a-2d1c5e","tenant":"e2e-shared-a-38da25","userId":"dd4f1042-f48a-44a9-877c-a16e0ea41254","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-24T00:57:37Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"65b0127b-5614-4191-a2af-f3e659fa6c02","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-38da25.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-38da25/rate-test-model-38da25\",\"requestedSubscription\":\"e2e-rate-iso-a-2d1c5e\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-24T00:57:37Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"65b0127b-5614-4191-a2af-f3e659fa6c02","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-38da25.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-38da25","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-2d1c5e","namespace":"ai-tenant-e2e-shared-a-38da25","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-38da25/rate-test-model-38da25"}}
{"level":"debug","ts":"2026-07-24T00:57:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"65b0127b-5614-4191-a2af-f3e659fa6c02","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T00:57:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"65b0127b-5614-4191-a2af-f3e659fa6c02","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T00:57:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"65b0127b-5614-4191-a2af-f3e659fa6c02","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T00:57:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"65b0127b-5614-4191-a2af-f3e659fa6c02","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-38da25/rate-test-model-38da25\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-38da25/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T00:57:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"65b0127b-5614-4191-a2af-f3e659fa6c02","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T00:57:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"65b0127b-5614-4191-a2af-f3e659fa6c02","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T00:57:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"65b0127b-5614-4191-a2af-f3e659fa6c02","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-24T00:57:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"65b0127b-5614-4191-a2af-f3e659fa6c02","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-2d1c5e"}
{"level":"debug","ts":"2026-07-24T00:57:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"65b0127b-5614-4191-a2af-f3e659fa6c02","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"dd4f1042-f48a-44a9-877c-a16e0ea41254","keyName":"e2e-rate-a-2d1c5e","selected_subscription":"e2e-rate-iso-a-2d1c5e","selected_subscription_key":"ai-tenant-e2e-shared-a-38da25/e2e-rate-iso-a-2d1c5e@ai-tenant-e2e-shared-a-38da25/rate-test-model-38da25","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-38da25","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-2d1c5e","namespace":"ai-tenant-e2e-shared-a-38da25","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-38da25/rate-test-model-38da25"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-24T00:57:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"65b0127b-5614-4191-a2af-f3e659fa6c02","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T00:57:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"65b0127b-5614-4191-a2af-f3e659fa6c02","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T00:57:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7d076b36-91d6-4831-950d-fcf78487090b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.10:39106","PortSpecifier":{"PortValue":39106}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.65:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"7d076b36-91d6-4831-950d-fcf78487090b","method":"POST","path":"/ai-tenant-e2e-shared-a-38da25/rate-test-model-38da25/v1/completions","host":"e2e-shared-a-38da25.apps.08e98f4e-5bc6-4a15-8c99-991d7235bd49.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T00:57:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7d076b36-91d6-4831-950d-fcf78487090b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.10:39106","PortSpecifier":{"PortValue":39106}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.65:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784854658,"nanos":398446276},"http":{"id":"7d076b36-91d6-4831-950d-fcf78487090b","method":"POST","headers":{":authority":"e2e-shared-a-38da25.apps.08e98f4e-5bc6-4a15-8c99-991d7235bd49.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-38da25/rate-test-model-38da25/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T00:57:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"7d076b36-91d6-4831-950d-fcf78487090b","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1G0Os0hgqhIgscNVu_CWyYMWL2mYPIxWUYnilQhP8UU9KLzmUqGt9wqVoBMFx"}
{"level":"debug","ts":"2026-07-24T00:57:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"7d076b36-91d6-4831-950d-fcf78487090b","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-38da25.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1G0Os0hgqhIgscNVu_CWyYMWL2mYPIxWUYnilQhP8UU9KLzmUqGt9wqVoBMFx\"}"}
{"level":"debug","ts":"2026-07-24T00:57:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"7d076b36-91d6-4831-950d-fcf78487090b","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-38da25.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"dd4f1042-f48a-44a9-877c-a16e0ea41254","keyName":"e2e-rate-a-2d1c5e","subscription":"e2e-rate-iso-a-2d1c5e","tenant":"e2e-shared-a-38da25","userId":"dd4f1042-f48a-44a9-877c-a16e0ea41254","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-24T00:57:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"7d076b36-91d6-4831-950d-fcf78487090b","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-38da25.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-38da25/rate-test-model-38da25\",\"requestedSubscription\":\"e2e-rate-iso-a-2d1c5e\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-24T00:57:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"7d076b36-91d6-4831-950d-fcf78487090b","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-38da25.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-38da25","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-2d1c5e","namespace":"ai-tenant-e2e-shared-a-38da25","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-38da25/rate-test-model-38da25"}}
{"level":"debug","ts":"2026-07-24T00:57:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"7d076b36-91d6-4831-950d-fcf78487090b","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T00:57:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7d076b36-91d6-4831-950d-fcf78487090b","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T00:57:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7d076b36-91d6-4831-950d-fcf78487090b","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T00:57:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7d076b36-91d6-4831-950d-fcf78487090b","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T00:57:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7d076b36-91d6-4831-950d-fcf78487090b","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-38da25/rate-test-model-38da25\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-38da25/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T00:57:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7d076b36-91d6-4831-950d-fcf78487090b","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T00:57:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7d076b36-91d6-4831-950d-fcf78487090b","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-24T00:57:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7d076b36-91d6-4831-950d-fcf78487090b","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-2d1c5e"}
{"level":"debug","ts":"2026-07-24T00:57:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7d076b36-91d6-4831-950d-fcf78487090b","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"dd4f1042-f48a-44a9-877c-a16e0ea41254","keyName":"e2e-rate-a-2d1c5e","selected_subscription":"e2e-rate-iso-a-2d1c5e","selected_subscription_key":"ai-tenant-e2e-shared-a-38da25/e2e-rate-iso-a-2d1c5e@ai-tenant-e2e-shared-a-38da25/rate-test-model-38da25","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-38da25","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-2d1c5e","namespace":"ai-tenant-e2e-shared-a-38da25","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-38da25/rate-test-model-38da25"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-24T00:57:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7d076b36-91d6-4831-950d-fcf78487090b","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T00:57:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7d076b36-91d6-4831-950d-fcf78487090b","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T00:57:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"cb642e15-e977-40d1-b046-e83312e7b2b1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.10:39112","PortSpecifier":{"PortValue":39112}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.65:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"cb642e15-e977-40d1-b046-e83312e7b2b1","method":"POST","path":"/ai-tenant-e2e-shared-a-38da25/rate-test-model-38da25/v1/completions","host":"e2e-shared-a-38da25.apps.08e98f4e-5bc6-4a15-8c99-991d7235bd49.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T00:57:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"cb642e15-e977-40d1-b046-e83312e7b2b1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.10:39112","PortSpecifier":{"PortValue":39112}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.65:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784854659,"nanos":438394615},"http":{"id":"cb642e15-e977-40d1-b046-e83312e7b2b1","method":"POST","headers":{":authority":"e2e-shared-a-38da25.apps.08e98f4e-5bc6-4a15-8c99-991d7235bd49.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-38da25/rate-test-model-38da25/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T00:57:39Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"cb642e15-e977-40d1-b046-e83312e7b2b1","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1G0Os0hgqhIgscNVu_CWyYMWL2mYPIxWUYnilQhP8UU9KLzmUqGt9wqVoBMFx"}
{"level":"debug","ts":"2026-07-24T00:57:39Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"cb642e15-e977-40d1-b046-e83312e7b2b1","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-38da25.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1G0Os0hgqhIgscNVu_CWyYMWL2mYPIxWUYnilQhP8UU9KLzmUqGt9wqVoBMFx\"}"}
{"level":"debug","ts":"2026-07-24T00:57:39Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"cb642e15-e977-40d1-b046-e83312e7b2b1","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-38da25.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"dd4f1042-f48a-44a9-877c-a16e0ea41254","keyName":"e2e-rate-a-2d1c5e","subscription":"e2e-rate-iso-a-2d1c5e","tenant":"e2e-shared-a-38da25","userId":"dd4f1042-f48a-44a9-877c-a16e0ea41254","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-24T00:57:39Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"cb642e15-e977-40d1-b046-e83312e7b2b1","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-38da25.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-38da25/rate-test-model-38da25\",\"requestedSubscription\":\"e2e-rate-iso-a-2d1c5e\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-24T00:57:39Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"cb642e15-e977-40d1-b046-e83312e7b2b1","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-38da25.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-38da25","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-2d1c5e","namespace":"ai-tenant-e2e-shared-a-38da25","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-38da25/rate-test-model-38da25"}}
{"level":"debug","ts":"2026-07-24T00:57:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"cb642e15-e977-40d1-b046-e83312e7b2b1","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T00:57:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cb642e15-e977-40d1-b046-e83312e7b2b1","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T00:57:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cb642e15-e977-40d1-b046-e83312e7b2b1","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T00:57:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cb642e15-e977-40d1-b046-e83312e7b2b1","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T00:57:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cb642e15-e977-40d1-b046-e83312e7b2b1","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-38da25/rate-test-model-38da25\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-38da25/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T00:57:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cb642e15-e977-40d1-b046-e83312e7b2b1","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T00:57:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cb642e15-e977-40d1-b046-e83312e7b2b1","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-2d1c5e"}
{"level":"debug","ts":"2026-07-24T00:57:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cb642e15-e977-40d1-b046-e83312e7b2b1","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-24T00:57:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cb642e15-e977-40d1-b046-e83312e7b2b1","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"dd4f1042-f48a-44a9-877c-a16e0ea41254","keyName":"e2e-rate-a-2d1c5e","selected_subscription":"e2e-rate-iso-a-2d1c5e","selected_subscription_key":"ai-tenant-e2e-shared-a-38da25/e2e-rate-iso-a-2d1c5e@ai-tenant-e2e-shared-a-38da25/rate-test-model-38da25","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-38da25","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-2d1c5e","namespace":"ai-tenant-e2e-shared-a-38da25","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-38da25/rate-test-model-38da25"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-24T00:57:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"cb642e15-e977-40d1-b046-e83312e7b2b1","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T00:57:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"cb642e15-e977-40d1-b046-e83312e7b2b1","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T00:57:40Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8e1a93cd-ee07-478d-aa1c-90a7503fb58c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.10:39128","PortSpecifier":{"PortValue":39128}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.65:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"8e1a93cd-ee07-478d-aa1c-90a7503fb58c","method":"POST","path":"/ai-tenant-e2e-shared-a-38da25/rate-test-model-38da25/v1/completions","host":"e2e-shared-a-38da25.apps.08e98f4e-5bc6-4a15-8c99-991d7235bd49.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T00:57:40Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8e1a93cd-ee07-478d-aa1c-90a7503fb58c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.10:39128","PortSpecifier":{"PortValue":39128}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.65:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784854660,"nanos":477695377},"http":{"id":"8e1a93cd-ee07-478d-aa1c-90a7503fb58c","method":"POST","headers":{":authority":"e2e-shared-a-38da25.apps.08e98f4e-5bc6-4a15-8c99-991d7235bd49.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-38da25/rate-test-model-38da25/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T00:57:40Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"8e1a93cd-ee07-478d-aa1c-90a7503fb58c","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1G0Os0hgqhIgscNVu_CWyYMWL2mYPIxWUYnilQhP8UU9KLzmUqGt9wqVoBMFx"}
{"level":"debug","ts":"2026-07-24T00:57:40Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"8e1a93cd-ee07-478d-aa1c-90a7503fb58c","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-38da25.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1G0Os0hgqhIgscNVu_CWyYMWL2mYPIxWUYnilQhP8UU9KLzmUqGt9wqVoBMFx\"}"}
{"level":"debug","ts":"2026-07-24T00:57:40Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"8e1a93cd-ee07-478d-aa1c-90a7503fb58c","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-38da25.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"dd4f1042-f48a-44a9-877c-a16e0ea41254","keyName":"e2e-rate-a-2d1c5e","subscription":"e2e-rate-iso-a-2d1c5e","tenant":"e2e-shared-a-38da25","userId":"dd4f1042-f48a-44a9-877c-a16e0ea41254","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-24T00:57:40Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"8e1a93cd-ee07-478d-aa1c-90a7503fb58c","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-38da25.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-38da25/rate-test-model-38da25\",\"requestedSubscription\":\"e2e-rate-iso-a-2d1c5e\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-24T00:57:40Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"8e1a93cd-ee07-478d-aa1c-90a7503fb58c","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-38da25.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-38da25","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-2d1c5e","namespace":"ai-tenant-e2e-shared-a-38da25","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-38da25/rate-test-model-38da25"}}
{"level":"debug","ts":"2026-07-24T00:57:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"8e1a93cd-ee07-478d-aa1c-90a7503fb58c","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T00:57:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8e1a93cd-ee07-478d-aa1c-90a7503fb58c","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T00:57:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8e1a93cd-ee07-478d-aa1c-90a7503fb58c","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T00:57:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8e1a93cd-ee07-478d-aa1c-90a7503fb58c","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-38da25/rate-test-model-38da25\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-38da25/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T00:57:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8e1a93cd-ee07-478d-aa1c-90a7503fb58c","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T00:57:40Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8e1a93cd-ee07-478d-aa1c-90a7503fb58c","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T00:57:40Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8e1a93cd-ee07-478d-aa1c-90a7503fb58c","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-24T00:57:40Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8e1a93cd-ee07-478d-aa1c-90a7503fb58c","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-2d1c5e"}
{"level":"debug","ts":"2026-07-24T00:57:40Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8e1a93cd-ee07-478d-aa1c-90a7503fb58c","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"dd4f1042-f48a-44a9-877c-a16e0ea41254","keyName":"e2e-rate-a-2d1c5e","selected_subscription":"e2e-rate-iso-a-2d1c5e","selected_subscription_key":"ai-tenant-e2e-shared-a-38da25/e2e-rate-iso-a-2d1c5e@ai-tenant-e2e-shared-a-38da25/rate-test-model-38da25","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-38da25","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-2d1c5e","namespace":"ai-tenant-e2e-shared-a-38da25","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-38da25/rate-test-model-38da25"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-24T00:57:40Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8e1a93cd-ee07-478d-aa1c-90a7503fb58c","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T00:57:40Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8e1a93cd-ee07-478d-aa1c-90a7503fb58c","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T00:57:41Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e4b4bf36-ecd6-481a-8c95-01a95fbb5848","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.10:39142","PortSpecifier":{"PortValue":39142}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.65:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"e4b4bf36-ecd6-481a-8c95-01a95fbb5848","method":"POST","path":"/ai-tenant-e2e-shared-a-38da25/rate-test-model-38da25/v1/completions","host":"e2e-shared-a-38da25.apps.08e98f4e-5bc6-4a15-8c99-991d7235bd49.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T00:57:41Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e4b4bf36-ecd6-481a-8c95-01a95fbb5848","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.10:39142","PortSpecifier":{"PortValue":39142}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.65:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784854661,"nanos":525826478},"http":{"id":"e4b4bf36-ecd6-481a-8c95-01a95fbb5848","method":"POST","headers":{":authority":"e2e-shared-a-38da25.apps.08e98f4e-5bc6-4a15-8c99-991d7235bd49.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-38da25/rate-test-model-38da25/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T00:57:41Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"e4b4bf36-ecd6-481a-8c95-01a95fbb5848","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1G0Os0hgqhIgscNVu_CWyYMWL2mYPIxWUYnilQhP8UU9KLzmUqGt9wqVoBMFx"}
{"level":"debug","ts":"2026-07-24T00:57:41Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"e4b4bf36-ecd6-481a-8c95-01a95fbb5848","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-38da25.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1G0Os0hgqhIgscNVu_CWyYMWL2mYPIxWUYnilQhP8UU9KLzmUqGt9wqVoBMFx\"}"}
{"level":"debug","ts":"2026-07-24T00:57:41Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"e4b4bf36-ecd6-481a-8c95-01a95fbb5848","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-38da25.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"dd4f1042-f48a-44a9-877c-a16e0ea41254","keyName":"e2e-rate-a-2d1c5e","subscription":"e2e-rate-iso-a-2d1c5e","tenant":"e2e-shared-a-38da25","userId":"dd4f1042-f48a-44a9-877c-a16e0ea41254","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-24T00:57:41Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"e4b4bf36-ecd6-481a-8c95-01a95fbb5848","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-38da25.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-38da25/rate-test-model-38da25\",\"requestedSubscription\":\"e2e-rate-iso-a-2d1c5e\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-24T00:57:41Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"e4b4bf36-ecd6-481a-8c95-01a95fbb5848","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-38da25.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-38da25","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-2d1c5e","namespace":"ai-tenant-e2e-shared-a-38da25","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-38da25/rate-test-model-38da25"}}
{"level":"debug","ts":"2026-07-24T00:57:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"e4b4bf36-ecd6-481a-8c95-01a95fbb5848","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T00:57:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e4b4bf36-ecd6-481a-8c95-01a95fbb5848","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T00:57:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e4b4bf36-ecd6-481a-8c95-01a95fbb5848","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T00:57:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e4b4bf36-ecd6-481a-8c95-01a95fbb5848","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-38da25/rate-test-model-38da25\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-38da25/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T00:57:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e4b4bf36-ecd6-481a-8c95-01a95fbb5848","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T00:57:41Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e4b4bf36-ecd6-481a-8c95-01a95fbb5848","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T00:57:41Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e4b4bf36-ecd6-481a-8c95-01a95fbb5848","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-2d1c5e"}
{"level":"debug","ts":"2026-07-24T00:57:41Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e4b4bf36-ecd6-481a-8c95-01a95fbb5848","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-24T00:57:41Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e4b4bf36-ecd6-481a-8c95-01a95fbb5848","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"dd4f1042-f48a-44a9-877c-a16e0ea41254","keyName":"e2e-rate-a-2d1c5e","selected_subscription":"e2e-rate-iso-a-2d1c5e","selected_subscription_key":"ai-tenant-e2e-shared-a-38da25/e2e-rate-iso-a-2d1c5e@ai-tenant-e2e-shared-a-38da25/rate-test-model-38da25","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-38da25","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-2d1c5e","namespace":"ai-tenant-e2e-shared-a-38da25","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-38da25/rate-test-model-38da25"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-24T00:57:41Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e4b4bf36-ecd6-481a-8c95-01a95fbb5848","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T00:57:41Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e4b4bf36-ecd6-481a-8c95-01a95fbb5848","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T00:57:42Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f2b02a3f-982d-4be9-88b4-15b94e6c4e64","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.10:39156","PortSpecifier":{"PortValue":39156}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.65:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"f2b02a3f-982d-4be9-88b4-15b94e6c4e64","method":"POST","path":"/ai-tenant-e2e-shared-a-38da25/rate-test-model-38da25/v1/completions","host":"e2e-shared-a-38da25.apps.08e98f4e-5bc6-4a15-8c99-991d7235bd49.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T00:57:42Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f2b02a3f-982d-4be9-88b4-15b94e6c4e64","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.10:39156","PortSpecifier":{"PortValue":39156}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.65:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784854662,"nanos":565872807},"http":{"id":"f2b02a3f-982d-4be9-88b4-15b94e6c4e64","method":"POST","headers":{":authority":"e2e-shared-a-38da25.apps.08e98f4e-5bc6-4a15-8c99-991d7235bd49.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-38da25/rate-test-model-38da25/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T00:57:42Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"f2b02a3f-982d-4be9-88b4-15b94e6c4e64","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1G0Os0hgqhIgscNVu_CWyYMWL2mYPIxWUYnilQhP8UU9KLzmUqGt9wqVoBMFx"}
{"level":"debug","ts":"2026-07-24T00:57:42Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"f2b02a3f-982d-4be9-88b4-15b94e6c4e64","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-38da25.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1G0Os0hgqhIgscNVu_CWyYMWL2mYPIxWUYnilQhP8UU9KLzmUqGt9wqVoBMFx\"}"}
{"level":"debug","ts":"2026-07-24T00:57:42Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"f2b02a3f-982d-4be9-88b4-15b94e6c4e64","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-38da25.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"dd4f1042-f48a-44a9-877c-a16e0ea41254","keyName":"e2e-rate-a-2d1c5e","subscription":"e2e-rate-iso-a-2d1c5e","tenant":"e2e-shared-a-38da25","userId":"dd4f1042-f48a-44a9-877c-a16e0ea41254","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-24T00:57:42Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"f2b02a3f-982d-4be9-88b4-15b94e6c4e64","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-38da25.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-38da25/rate-test-model-38da25\",\"requestedSubscription\":\"e2e-rate-iso-a-2d1c5e\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-24T00:57:42Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"f2b02a3f-982d-4be9-88b4-15b94e6c4e64","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-38da25.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-38da25","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-2d1c5e","namespace":"ai-tenant-e2e-shared-a-38da25","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-38da25/rate-test-model-38da25"}}
{"level":"debug","ts":"2026-07-24T00:57:42Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"f2b02a3f-982d-4be9-88b4-15b94e6c4e64","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T00:57:42Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f2b02a3f-982d-4be9-88b4-15b94e6c4e64","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T00:57:42Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f2b02a3f-982d-4be9-88b4-15b94e6c4e64","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T00:57:42Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f2b02a3f-982d-4be9-88b4-15b94e6c4e64","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-38da25/rate-test-model-38da25\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-38da25/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T00:57:42Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f2b02a3f-982d-4be9-88b4-15b94e6c4e64","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T00:57:42Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f2b02a3f-982d-4be9-88b4-15b94e6c4e64","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-24T00:57:42Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f2b02a3f-982d-4be9-88b4-15b94e6c4e64","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T00:57:42Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f2b02a3f-982d-4be9-88b4-15b94e6c4e64","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-2d1c5e"}
{"level":"debug","ts":"2026-07-24T00:57:42Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f2b02a3f-982d-4be9-88b4-15b94e6c4e64","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"dd4f1042-f48a-44a9-877c-a16e0ea41254","keyName":"e2e-rate-a-2d1c5e","selected_subscription":"e2e-rate-iso-a-2d1c5e","selected_subscription_key":"ai-tenant-e2e-shared-a-38da25/e2e-rate-iso-a-2d1c5e@ai-tenant-e2e-shared-a-38da25/rate-test-model-38da25","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-38da25","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-2d1c5e","namespace":"ai-tenant-e2e-shared-a-38da25","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-38da25/rate-test-model-38da25"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-24T00:57:42Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f2b02a3f-982d-4be9-88b4-15b94e6c4e64","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T00:57:42Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f2b02a3f-982d-4be9-88b4-15b94e6c4e64","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T00:57:51Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8eac5b45-4f15-4bd1-8d20-0d7d9334f721","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.10:42436","PortSpecifier":{"PortValue":42436}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.65:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"8eac5b45-4f15-4bd1-8d20-0d7d9334f721","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-38da25.apps.08e98f4e-5bc6-4a15-8c99-991d7235bd49.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T00:57:51Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8eac5b45-4f15-4bd1-8d20-0d7d9334f721","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.10:42436","PortSpecifier":{"PortValue":42436}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.65:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784854671,"nanos":320367435},"http":{"id":"8eac5b45-4f15-4bd1-8d20-0d7d9334f721","method":"POST","headers":{":authority":"e2e-shared-a-38da25.apps.08e98f4e-5bc6-4a15-8c99-991d7235bd49.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T00:57:51Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"8eac5b45-4f15-4bd1-8d20-0d7d9334f721","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-24T00:57:51Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"8eac5b45-4f15-4bd1-8d20-0d7d9334f721","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"001ff030-ee9f-4e4a-8c3f-81e970dac168","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=fc707eb4-0a4a-4f24-aaba-02ba27004cae"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/991d7235bd49"]}}
{"level":"debug","ts":"2026-07-24T00:57:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"8eac5b45-4f15-4bd1-8d20-0d7d9334f721","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/991d7235bd49"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=fc707eb4-0a4a-4f24-aaba-02ba27004cae"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"001ff030-ee9f-4e4a-8c3f-81e970dac168","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"31d845d67309c1e120de70a5e325f9a7b325333eac1adcdb46ac2101ff35c706"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.65:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-38da25.apps.08e98f4e-5bc6-4a15-8c99-991d7235bd49.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T00:57:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8eac5b45-4f15-4bd1-8d20-0d7d9334f721","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T00:57:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8eac5b45-4f15-4bd1-8d20-0d7d9334f721","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T00:57:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8eac5b45-4f15-4bd1-8d20-0d7d9334f721","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-38da25/rate-test-model-38da25\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-38da25/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T00:57:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"8eac5b45-4f15-4bd1-8d20-0d7d9334f721","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-24T00:57:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8eac5b45-4f15-4bd1-8d20-0d7d9334f721","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T00:57:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8eac5b45-4f15-4bd1-8d20-0d7d9334f721","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-24T00:57:51Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8eac5b45-4f15-4bd1-8d20-0d7d9334f721","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T00:57:51Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8eac5b45-4f15-4bd1-8d20-0d7d9334f721","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T00:57:51Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f3961619-aa6d-47f7-a525-759d83df4103","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.10:36388","PortSpecifier":{"PortValue":36388}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.66:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"f3961619-aa6d-47f7-a525-759d83df4103","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-44edfc.apps.08e98f4e-5bc6-4a15-8c99-991d7235bd49.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T00:57:51Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f3961619-aa6d-47f7-a525-759d83df4103","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.10:36388","PortSpecifier":{"PortValue":36388}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.66:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784854671,"nanos":358534482},"http":{"id":"f3961619-aa6d-47f7-a525-759d83df4103","method":"POST","headers":{":authority":"e2e-shared-b-44edfc.apps.08e98f4e-5bc6-4a15-8c99-991d7235bd49.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T00:57:51Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"f3961619-aa6d-47f7-a525-759d83df4103","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-24T00:57:51Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"f3961619-aa6d-47f7-a525-759d83df4103","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"001ff030-ee9f-4e4a-8c3f-81e970dac168","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=fc707eb4-0a4a-4f24-aaba-02ba27004cae"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/991d7235bd49"]}}
{"level":"debug","ts":"2026-07-24T00:57:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"f3961619-aa6d-47f7-a525-759d83df4103","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/991d7235bd49"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=fc707eb4-0a4a-4f24-aaba-02ba27004cae"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"001ff030-ee9f-4e4a-8c3f-81e970dac168","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"90a2e34c5e02590e3c0b268545a38913a3b58abbbe6a03164326e70c2cbd16fa"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.66:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-44edfc.apps.08e98f4e-5bc6-4a15-8c99-991d7235bd49.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T00:57:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f3961619-aa6d-47f7-a525-759d83df4103","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T00:57:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f3961619-aa6d-47f7-a525-759d83df4103","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T00:57:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f3961619-aa6d-47f7-a525-759d83df4103","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-44edfc/rate-test-model-44edfc\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-44edfc/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T00:57:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"f3961619-aa6d-47f7-a525-759d83df4103","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-24T00:57:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f3961619-aa6d-47f7-a525-759d83df4103","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T00:57:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f3961619-aa6d-47f7-a525-759d83df4103","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-24T00:57:51Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f3961619-aa6d-47f7-a525-759d83df4103","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T00:57:51Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f3961619-aa6d-47f7-a525-759d83df4103","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T00:57:51Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"15dfac3c-4f99-42f2-9fc5-2e3f4f23dbff","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.10:42442","PortSpecifier":{"PortValue":42442}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.65:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"15dfac3c-4f99-42f2-9fc5-2e3f4f23dbff","method":"POST","path":"/ai-tenant-e2e-shared-a-38da25/rate-test-model-38da25/v1/completions","host":"e2e-shared-a-38da25.apps.08e98f4e-5bc6-4a15-8c99-991d7235bd49.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T00:57:51Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"15dfac3c-4f99-42f2-9fc5-2e3f4f23dbff","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.10:42442","PortSpecifier":{"PortValue":42442}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.65:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784854671,"nanos":393726802},"http":{"id":"15dfac3c-4f99-42f2-9fc5-2e3f4f23dbff","method":"POST","headers":{":authority":"e2e-shared-a-38da25.apps.08e98f4e-5bc6-4a15-8c99-991d7235bd49.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-38da25/rate-test-model-38da25/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T00:57:51Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"15dfac3c-4f99-42f2-9fc5-2e3f4f23dbff","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-xNdLw6K3OgPzbNfT_B216v0SFEIcoleYwdRWnJPKVcubeCyDXBQeEOPfV1Do"}
{"level":"debug","ts":"2026-07-24T00:57:51Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"15dfac3c-4f99-42f2-9fc5-2e3f4f23dbff","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-38da25.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-xNdLw6K3OgPzbNfT_B216v0SFEIcoleYwdRWnJPKVcubeCyDXBQeEOPfV1Do\"}"}
{"level":"debug","ts":"2026-07-24T00:57:51Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"15dfac3c-4f99-42f2-9fc5-2e3f4f23dbff","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-38da25.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"5fc7d229-e8a0-4929-bed3-42c4ee88a6e2","keyName":"e2e-rate-a-4fddb3","subscription":"e2e-rate-iso-a-4fddb3","tenant":"e2e-shared-a-38da25","userId":"5fc7d229-e8a0-4929-bed3-42c4ee88a6e2","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-24T00:57:51Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"15dfac3c-4f99-42f2-9fc5-2e3f4f23dbff","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-38da25.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-38da25/rate-test-model-38da25\",\"requestedSubscription\":\"e2e-rate-iso-a-4fddb3\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-24T00:57:51Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"15dfac3c-4f99-42f2-9fc5-2e3f4f23dbff","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-38da25.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-38da25","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-4fddb3","namespace":"ai-tenant-e2e-shared-a-38da25","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-38da25/rate-test-model-38da25"}}
{"level":"debug","ts":"2026-07-24T00:57:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"15dfac3c-4f99-42f2-9fc5-2e3f4f23dbff","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T00:57:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"15dfac3c-4f99-42f2-9fc5-2e3f4f23dbff","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T00:57:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"15dfac3c-4f99-42f2-9fc5-2e3f4f23dbff","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T00:57:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"15dfac3c-4f99-42f2-9fc5-2e3f4f23dbff","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T00:57:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"15dfac3c-4f99-42f2-9fc5-2e3f4f23dbff","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-38da25/rate-test-model-38da25\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-38da25/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T00:57:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"15dfac3c-4f99-42f2-9fc5-2e3f4f23dbff","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-24T00:57:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"15dfac3c-4f99-42f2-9fc5-2e3f4f23dbff","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-4fddb3"}
{"level":"debug","ts":"2026-07-24T00:57:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"15dfac3c-4f99-42f2-9fc5-2e3f4f23dbff","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T00:57:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"15dfac3c-4f99-42f2-9fc5-2e3f4f23dbff","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"5fc7d229-e8a0-4929-bed3-42c4ee88a6e2","keyName":"e2e-rate-a-4fddb3","selected_subscription":"e2e-rate-iso-a-4fddb3","selected_subscription_key":"ai-tenant-e2e-shared-a-38da25/e2e-rate-iso-a-4fddb3@ai-tenant-e2e-shared-a-38da25/rate-test-model-38da25","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-38da25","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-4fddb3","namespace":"ai-tenant-e2e-shared-a-38da25","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-38da25/rate-test-model-38da25"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-24T00:57:51Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"15dfac3c-4f99-42f2-9fc5-2e3f4f23dbff","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T00:57:51Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"15dfac3c-4f99-42f2-9fc5-2e3f4f23dbff","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T00:57:52Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"71184a84-6be2-48be-829c-44430bb0f4cc","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.10:42456","PortSpecifier":{"PortValue":42456}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.65:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"71184a84-6be2-48be-829c-44430bb0f4cc","method":"POST","path":"/ai-tenant-e2e-shared-a-38da25/rate-test-model-38da25/v1/completions","host":"e2e-shared-a-38da25.apps.08e98f4e-5bc6-4a15-8c99-991d7235bd49.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T00:57:52Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"71184a84-6be2-48be-829c-44430bb0f4cc","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.10:42456","PortSpecifier":{"PortValue":42456}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.65:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784854672,"nanos":432510915},"http":{"id":"71184a84-6be2-48be-829c-44430bb0f4cc","method":"POST","headers":{":authority":"e2e-shared-a-38da25.apps.08e98f4e-5bc6-4a15-8c99-991d7235bd49.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-38da25/rate-test-model-38da25/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T00:57:52Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"71184a84-6be2-48be-829c-44430bb0f4cc","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-xNdLw6K3OgPzbNfT_B216v0SFEIcoleYwdRWnJPKVcubeCyDXBQeEOPfV1Do"}
{"level":"debug","ts":"2026-07-24T00:57:52Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"71184a84-6be2-48be-829c-44430bb0f4cc","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-38da25.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-xNdLw6K3OgPzbNfT_B216v0SFEIcoleYwdRWnJPKVcubeCyDXBQeEOPfV1Do\"}"}
{"level":"debug","ts":"2026-07-24T00:57:52Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"71184a84-6be2-48be-829c-44430bb0f4cc","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-38da25.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"5fc7d229-e8a0-4929-bed3-42c4ee88a6e2","keyName":"e2e-rate-a-4fddb3","subscription":"e2e-rate-iso-a-4fddb3","tenant":"e2e-shared-a-38da25","userId":"5fc7d229-e8a0-4929-bed3-42c4ee88a6e2","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-24T00:57:52Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"71184a84-6be2-48be-829c-44430bb0f4cc","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-38da25.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-38da25/rate-test-model-38da25\",\"requestedSubscription\":\"e2e-rate-iso-a-4fddb3\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-24T00:57:52Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"71184a84-6be2-48be-829c-44430bb0f4cc","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-38da25.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-38da25","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-4fddb3","namespace":"ai-tenant-e2e-shared-a-38da25","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-38da25/rate-test-model-38da25"}}
{"level":"debug","ts":"2026-07-24T00:57:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"71184a84-6be2-48be-829c-44430bb0f4cc","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T00:57:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"71184a84-6be2-48be-829c-44430bb0f4cc","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T00:57:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"71184a84-6be2-48be-829c-44430bb0f4cc","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T00:57:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"71184a84-6be2-48be-829c-44430bb0f4cc","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T00:57:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"71184a84-6be2-48be-829c-44430bb0f4cc","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-38da25/rate-test-model-38da25\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-38da25/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T00:57:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"71184a84-6be2-48be-829c-44430bb0f4cc","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T00:57:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"71184a84-6be2-48be-829c-44430bb0f4cc","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-24T00:57:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"71184a84-6be2-48be-829c-44430bb0f4cc","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-4fddb3"}
{"level":"debug","ts":"2026-07-24T00:57:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"71184a84-6be2-48be-829c-44430bb0f4cc","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"5fc7d229-e8a0-4929-bed3-42c4ee88a6e2","keyName":"e2e-rate-a-4fddb3","selected_subscription":"e2e-rate-iso-a-4fddb3","selected_subscription_key":"ai-tenant-e2e-shared-a-38da25/e2e-rate-iso-a-4fddb3@ai-tenant-e2e-shared-a-38da25/rate-test-model-38da25","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-38da25","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-4fddb3","namespace":"ai-tenant-e2e-shared-a-38da25","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-38da25/rate-test-model-38da25"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-24T00:57:52Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"71184a84-6be2-48be-829c-44430bb0f4cc","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T00:57:52Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"71184a84-6be2-48be-829c-44430bb0f4cc","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T00:57:53Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"417ad70f-420c-47ee-9ae9-ae65121d2de7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.10:39896","PortSpecifier":{"PortValue":39896}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.65:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"417ad70f-420c-47ee-9ae9-ae65121d2de7","method":"POST","path":"/ai-tenant-e2e-shared-a-38da25/rate-test-model-38da25/v1/completions","host":"e2e-shared-a-38da25.apps.08e98f4e-5bc6-4a15-8c99-991d7235bd49.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T00:57:53Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"417ad70f-420c-47ee-9ae9-ae65121d2de7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.10:39896","PortSpecifier":{"PortValue":39896}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.65:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784854673,"nanos":472641321},"http":{"id":"417ad70f-420c-47ee-9ae9-ae65121d2de7","method":"POST","headers":{":authority":"e2e-shared-a-38da25.apps.08e98f4e-5bc6-4a15-8c99-991d7235bd49.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-38da25/rate-test-model-38da25/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T00:57:53Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"417ad70f-420c-47ee-9ae9-ae65121d2de7","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-xNdLw6K3OgPzbNfT_B216v0SFEIcoleYwdRWnJPKVcubeCyDXBQeEOPfV1Do"}
{"level":"debug","ts":"2026-07-24T00:57:53Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"417ad70f-420c-47ee-9ae9-ae65121d2de7","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-38da25.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-xNdLw6K3OgPzbNfT_B216v0SFEIcoleYwdRWnJPKVcubeCyDXBQeEOPfV1Do\"}"}
{"level":"debug","ts":"2026-07-24T00:57:53Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"417ad70f-420c-47ee-9ae9-ae65121d2de7","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-38da25.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"5fc7d229-e8a0-4929-bed3-42c4ee88a6e2","keyName":"e2e-rate-a-4fddb3","subscription":"e2e-rate-iso-a-4fddb3","tenant":"e2e-shared-a-38da25","userId":"5fc7d229-e8a0-4929-bed3-42c4ee88a6e2","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-24T00:57:53Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"417ad70f-420c-47ee-9ae9-ae65121d2de7","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-38da25.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-38da25/rate-test-model-38da25\",\"requestedSubscription\":\"e2e-rate-iso-a-4fddb3\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-24T00:57:53Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"417ad70f-420c-47ee-9ae9-ae65121d2de7","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-38da25.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-38da25","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-4fddb3","namespace":"ai-tenant-e2e-shared-a-38da25","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-38da25/rate-test-model-38da25"}}
{"level":"debug","ts":"2026-07-24T00:57:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"417ad70f-420c-47ee-9ae9-ae65121d2de7","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T00:57:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"417ad70f-420c-47ee-9ae9-ae65121d2de7","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T00:57:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"417ad70f-420c-47ee-9ae9-ae65121d2de7","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T00:57:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"417ad70f-420c-47ee-9ae9-ae65121d2de7","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-38da25/rate-test-model-38da25\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-38da25/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T00:57:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"417ad70f-420c-47ee-9ae9-ae65121d2de7","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T00:57:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"417ad70f-420c-47ee-9ae9-ae65121d2de7","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T00:57:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"417ad70f-420c-47ee-9ae9-ae65121d2de7","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-4fddb3"}
{"level":"debug","ts":"2026-07-24T00:57:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"417ad70f-420c-47ee-9ae9-ae65121d2de7","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-24T00:57:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"417ad70f-420c-47ee-9ae9-ae65121d2de7","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"5fc7d229-e8a0-4929-bed3-42c4ee88a6e2","keyName":"e2e-rate-a-4fddb3","selected_subscription":"e2e-rate-iso-a-4fddb3","selected_subscription_key":"ai-tenant-e2e-shared-a-38da25/e2e-rate-iso-a-4fddb3@ai-tenant-e2e-shared-a-38da25/rate-test-model-38da25","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-38da25","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-4fddb3","namespace":"ai-tenant-e2e-shared-a-38da25","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-38da25/rate-test-model-38da25"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-24T00:57:53Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"417ad70f-420c-47ee-9ae9-ae65121d2de7","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T00:57:53Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"417ad70f-420c-47ee-9ae9-ae65121d2de7","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T00:57:53Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8e66f6cc-7c32-4181-b602-4419f9661496","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.10:59548","PortSpecifier":{"PortValue":59548}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.66:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"8e66f6cc-7c32-4181-b602-4419f9661496","method":"POST","path":"/ai-tenant-e2e-shared-b-44edfc/rate-test-model-44edfc/v1/completions","host":"e2e-shared-b-44edfc.apps.08e98f4e-5bc6-4a15-8c99-991d7235bd49.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T00:57:53Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8e66f6cc-7c32-4181-b602-4419f9661496","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.10:59548","PortSpecifier":{"PortValue":59548}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.66:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784854673,"nanos":508478392},"http":{"id":"8e66f6cc-7c32-4181-b602-4419f9661496","method":"POST","headers":{":authority":"e2e-shared-b-44edfc.apps.08e98f4e-5bc6-4a15-8c99-991d7235bd49.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-b-44edfc/rate-test-model-44edfc/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T00:57:53Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"8e66f6cc-7c32-4181-b602-4419f9661496","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-JenT7fXKwsiPqoek_ZQuaBs4P0VpsYzeQsl9XbAxrsV3zcIlM7CvFTzVH1I"}
{"level":"debug","ts":"2026-07-24T00:57:53Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"8e66f6cc-7c32-4181-b602-4419f9661496","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-b-44edfc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-JenT7fXKwsiPqoek_ZQuaBs4P0VpsYzeQsl9XbAxrsV3zcIlM7CvFTzVH1I\"}"}
{"level":"debug","ts":"2026-07-24T00:57:53Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"8e66f6cc-7c32-4181-b602-4419f9661496","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-44edfc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"646032de-3ed7-45af-b601-81ea74695bcd","keyName":"e2e-rate-b-4fddb3","subscription":"e2e-rate-iso-b-4fddb3","tenant":"e2e-shared-b-44edfc","userId":"646032de-3ed7-45af-b601-81ea74695bcd","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-24T00:57:53Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"8e66f6cc-7c32-4181-b602-4419f9661496","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-b-44edfc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-b-44edfc/rate-test-model-44edfc\",\"requestedSubscription\":\"e2e-rate-iso-b-4fddb3\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-24T00:57:53Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"8e66f6cc-7c32-4181-b602-4419f9661496","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-44edfc.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-44edfc","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-4fddb3","namespace":"ai-tenant-e2e-shared-b-44edfc","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-b-44edfc/rate-test-model-44edfc"}}
{"level":"debug","ts":"2026-07-24T00:57:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"8e66f6cc-7c32-4181-b602-4419f9661496","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T00:57:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8e66f6cc-7c32-4181-b602-4419f9661496","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T00:57:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8e66f6cc-7c32-4181-b602-4419f9661496","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T00:57:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8e66f6cc-7c32-4181-b602-4419f9661496","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-44edfc/rate-test-model-44edfc\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-44edfc/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T00:57:53Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8e66f6cc-7c32-4181-b602-4419f9661496","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T00:57:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8e66f6cc-7c32-4181-b602-4419f9661496","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T00:57:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8e66f6cc-7c32-4181-b602-4419f9661496","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-b-4fddb3"}
{"level":"debug","ts":"2026-07-24T00:57:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8e66f6cc-7c32-4181-b602-4419f9661496","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-24T00:57:53Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8e66f6cc-7c32-4181-b602-4419f9661496","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"646032de-3ed7-45af-b601-81ea74695bcd","keyName":"e2e-rate-b-4fddb3","selected_subscription":"e2e-rate-iso-b-4fddb3","selected_subscription_key":"ai-tenant-e2e-shared-b-44edfc/e2e-rate-iso-b-4fddb3@ai-tenant-e2e-shared-b-44edfc/rate-test-model-44edfc","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-44edfc","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-4fddb3","namespace":"ai-tenant-e2e-shared-b-44edfc","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-b-44edfc/rate-test-model-44edfc"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-24T00:57:53Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8e66f6cc-7c32-4181-b602-4419f9661496","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T00:57:53Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8e66f6cc-7c32-4181-b602-4419f9661496","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T00:57:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/45086379dc7e1da84ce69eca3c36aa1e40f0da1e7578183f9aebba77d9d208d6"}
{"level":"info","ts":"2026-07-24T00:57:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/c16297dd278718944a34aac273dd9179ec964057bab73fde34c334e69453431e"}
{"level":"info","ts":"2026-07-24T00:57:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/387134b33c966eda3d277d81872812f42fa28f282a404f4301c5f218b2040cd7"}
{"level":"info","ts":"2026-07-24T00:57:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/3e0dae33b70923000a3c832b857869263ef9bad39542f88a103e8e0d89b4dad9"}
{"level":"info","ts":"2026-07-24T00:57:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/04e2de1d4179885003c90c6f6ce1061f24733e5b181abdad44cb0e9065babcb7"}
{"level":"info","ts":"2026-07-24T00:57:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/02c2ac0bce9be51aee25a7459d11df90b6dcba2da842ee0683231a61392bc5b8"}
{"level":"info","ts":"2026-07-24T00:57:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/be8b07af7051089540a323a1a1bd45e3e46787a88db6cfc9628e42a5812778e3"}
{"level":"info","ts":"2026-07-24T00:57:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/90a2e34c5e02590e3c0b268545a38913a3b58abbbe6a03164326e70c2cbd16fa"}
{"level":"info","ts":"2026-07-24T00:57:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/02b9ed60fd45cd8306a8ffee8867fd5319a6116f8af363d5b41014b36e49b15c"}
{"level":"info","ts":"2026-07-24T00:57:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/2a46df1bfaec2fb33aed078d0fc163ea66eb8c1b108e9b4a73574562e40341c6"}
{"level":"info","ts":"2026-07-24T00:57:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/0f22ab4daec54892548669e309d0138486c70fe3fb5e5734efbe20e6e9f14759"}
{"level":"info","ts":"2026-07-24T00:57:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/f0e954ae611450add72e62b0e6d3a75d6dd9f5715511722d2606e8606aa8ae57"}
{"level":"info","ts":"2026-07-24T00:57:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/105ee4388979b1afdcf5701a8826c1b691d5cfbbacf4c9d9cf8968d8aeb87dc9"}
{"level":"info","ts":"2026-07-24T00:57:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/bec7b6d5a99d8961a75ce64292717531c77e65f8ae631608a346eb22f3eaa8d5"}
{"level":"info","ts":"2026-07-24T00:57:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/3a9fd81d9f4e05dc02c22b729bad48493bfd8a980cc5563b5bc69ca6458ee02e"}
{"level":"info","ts":"2026-07-24T00:57:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/7decb2aa3a66e37c9da067fdd2885aa25712ea5cad6ba1c6ef73bfec99f9fb4f"}
{"level":"info","ts":"2026-07-24T00:57:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/f9113bfb1297b78fd9c75e649ea62109b045b81538d99eca25feae22eb3ef663"}
{"level":"info","ts":"2026-07-24T00:57:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/8182179e493163dd8f0814b9840866a39a43f7176812e34cbe2326f6eab32740"}
{"level":"info","ts":"2026-07-24T00:57:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/2bb52d7fcf3ebd38588bd4d5c009f23fc6fbb4a2f91066c76d70a81b4aa8de7c"}
{"level":"info","ts":"2026-07-24T00:57:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/90daf5aab77c5abec66e7fb127ab39d42a0bd977f8cc57e7d4487539635461ca"}
{"level":"info","ts":"2026-07-24T00:57:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/31d845d67309c1e120de70a5e325f9a7b325333eac1adcdb46ac2101ff35c706"}
{"level":"info","ts":"2026-07-24T00:57:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/79021dc7bedbfde85a12487f6774a3b21ed15ec0a734275f85ed3d373458d18f"}
{"level":"info","ts":"2026-07-24T00:57:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/4dbcebaf17626c9b0b398d305058b65a448a23cb144df8fe6d22461b5d851916"}
{"level":"info","ts":"2026-07-24T00:57:59Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/b556a7ef37fb561d2187211734de649c016bf544e203dbe08c52250234545eaa"}
{"level":"info","ts":"2026-07-24T00:59:07Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"71890bfd-db7e-48be-984e-44af0470fcec","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.10:41510","PortSpecifier":{"PortValue":41510}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.41:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"71890bfd-db7e-48be-984e-44af0470fcec","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.08e98f4e-5bc6-4a15-8c99-991d7235bd49.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T00:59:07Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"71890bfd-db7e-48be-984e-44af0470fcec","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.10:41510","PortSpecifier":{"PortValue":41510}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.41:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784854747,"nanos":202232806},"http":{"id":"71890bfd-db7e-48be-984e-44af0470fcec","method":"POST","headers":{":authority":"maas.apps.08e98f4e-5bc6-4a15-8c99-991d7235bd49.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T00:59:07Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"71890bfd-db7e-48be-984e-44af0470fcec","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-24T00:59:07Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"71890bfd-db7e-48be-984e-44af0470fcec","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"001ff030-ee9f-4e4a-8c3f-81e970dac168","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=fc707eb4-0a4a-4f24-aaba-02ba27004cae"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/991d7235bd49"]}}
{"level":"debug","ts":"2026-07-24T00:59:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"71890bfd-db7e-48be-984e-44af0470fcec","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/991d7235bd49"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=fc707eb4-0a4a-4f24-aaba-02ba27004cae"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"001ff030-ee9f-4e4a-8c3f-81e970dac168","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.41:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.08e98f4e-5bc6-4a15-8c99-991d7235bd49.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T00:59:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"71890bfd-db7e-48be-984e-44af0470fcec","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T00:59:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"71890bfd-db7e-48be-984e-44af0470fcec","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T00:59:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"71890bfd-db7e-48be-984e-44af0470fcec","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]},\"publishers/llm/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/llm/models/facebook/opt-125m-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T00:59:07Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"71890bfd-db7e-48be-984e-44af0470fcec","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"keyId","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-24T00:59:07Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"71890bfd-db7e-48be-984e-44af0470fcec","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T00:59:07Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"71890bfd-db7e-48be-984e-44af0470fcec","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-24T00:59:07Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"71890bfd-db7e-48be-984e-44af0470fcec","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T00:59:07Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"71890bfd-db7e-48be-984e-44af0470fcec","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T00:59:07Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9111e977-3995-4d60-b8c5-c26b5db9f4ea","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.10:41514","PortSpecifier":{"PortValue":41514}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.41:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"9111e977-3995-4d60-b8c5-c26b5db9f4ea","method":"POST","path":"/llm/facebook-opt-125m-simulated/v1/chat/completions","host":"maas.apps.08e98f4e-5bc6-4a15-8c99-991d7235bd49.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T00:59:07Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9111e977-3995-4d60-b8c5-c26b5db9f4ea","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.10:41514","PortSpecifier":{"PortValue":41514}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.41:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784854747,"nanos":261345312},"http":{"id":"9111e977-3995-4d60-b8c5-c26b5db9f4ea","method":"POST","headers":{":authority":"maas.apps.08e98f4e-5bc6-4a15-8c99-991d7235bd49.prod.konfluxeaas.com",":method":"POST",":path":"/llm/facebook-opt-125m-simulated/v1/chat/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T00:59:07Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"9111e977-3995-4d60-b8c5-c26b5db9f4ea","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-mnJ1mtCqB87Ui9qS_HjgpdIDKpmCuGl9svABh67XZasqcxkJheHRi4cDYJ29"}
{"level":"debug","ts":"2026-07-24T00:59:07Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"9111e977-3995-4d60-b8c5-c26b5db9f4ea","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-mnJ1mtCqB87Ui9qS_HjgpdIDKpmCuGl9svABh67XZasqcxkJheHRi4cDYJ29\"}"}
{"level":"debug","ts":"2026-07-24T00:59:07Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"9111e977-3995-4d60-b8c5-c26b5db9f4ea","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"ac51443e-daab-4d05-99eb-a537e58f0ed6","keyName":"e2e-ipp-default","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"ac51443e-daab-4d05-99eb-a537e58f0ed6","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-24T00:59:07Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"9111e977-3995-4d60-b8c5-c26b5db9f4ea","config":"subscription-info","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"llm/facebook-opt-125m-simulated\",\"requestedSubscription\":\"simulator-subscription\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-24T00:59:07Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"9111e977-3995-4d60-b8c5-c26b5db9f4ea","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true,"resolvedModel":"llm/facebook-opt-125m-simulated"}}
{"level":"debug","ts":"2026-07-24T00:59:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"9111e977-3995-4d60-b8c5-c26b5db9f4ea","input":{"auth":{"identity":"Bearer **** subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true,"resolvedModel":"llm/facebook-opt-125m-simulated"}}},"context":{"context_extensions":{"host":"311b1be286674fd5684c9ac59b318287dade9769cfe4aeebd8c88e2dc6b72418"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.41:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.08e98f4e-5bc6-4a15-8c99-991d7235bd49.prod.konfluxeaas.com",":method":"POST",":path":"/llm/facebook-opt-125m-simulated/v1/chat/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T00:59:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9111e977-3995-4d60-b8c5-c26b5db9f4ea","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T00:59:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9111e977-3995-4d60-b8c5-c26b5db9f4ea","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T00:59:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9111e977-3995-4d60-b8c5-c26b5db9f4ea","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T00:59:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9111e977-3995-4d60-b8c5-c26b5db9f4ea","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]},\"publishers/llm/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/llm/models/facebook/opt-125m-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T00:59:07Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9111e977-3995-4d60-b8c5-c26b5db9f4ea","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-24T00:59:07Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9111e977-3995-4d60-b8c5-c26b5db9f4ea","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T00:59:07Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9111e977-3995-4d60-b8c5-c26b5db9f4ea","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-24T00:59:07Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9111e977-3995-4d60-b8c5-c26b5db9f4ea","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"ac51443e-daab-4d05-99eb-a537e58f0ed6","keyName":"e2e-ipp-default","selected_subscription":"simulator-subscription","selected_subscription_key":"models-as-a-service/simulator-subscription@llm/facebook-opt-125m-simulated","subscription_error":"","subscription_error_message":"","subscription_info":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true,"resolvedModel":"llm/facebook-opt-125m-simulated"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-24T00:59:07Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9111e977-3995-4d60-b8c5-c26b5db9f4ea","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T00:59:07Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9111e977-3995-4d60-b8c5-c26b5db9f4ea","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T00:59:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"40901c03c9dfa982e18fdab2bfa8c64d1bda5ffea180bcb1d04f77006e5715e7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T00:59:54Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T00:59:54Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T00:59:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"40901c03c9dfa982e18fdab2bfa8c64d1bda5ffea180bcb1d04f77006e5715e7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T00:59:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"40901c03c9dfa982e18fdab2bfa8c64d1bda5ffea180bcb1d04f77006e5715e7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T00:59:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"40901c03c9dfa982e18fdab2bfa8c64d1bda5ffea180bcb1d04f77006e5715e7","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T00:59:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/40901c03c9dfa982e18fdab2bfa8c64d1bda5ffea180bcb1d04f77006e5715e7"}
{"level":"debug","ts":"2026-07-24T00:59:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"40901c03c9dfa982e18fdab2bfa8c64d1bda5ffea180bcb1d04f77006e5715e7","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T00:59:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/40901c03c9dfa982e18fdab2bfa8c64d1bda5ffea180bcb1d04f77006e5715e7"}
{"level":"debug","ts":"2026-07-24T00:59:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"40901c03c9dfa982e18fdab2bfa8c64d1bda5ffea180bcb1d04f77006e5715e7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T00:59:54Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T00:59:54Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["40901c03c9dfa982e18fdab2bfa8c64d1bda5ffea180bcb1d04f77006e5715e7"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T00:59:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"40901c03c9dfa982e18fdab2bfa8c64d1bda5ffea180bcb1d04f77006e5715e7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T00:59:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"40901c03c9dfa982e18fdab2bfa8c64d1bda5ffea180bcb1d04f77006e5715e7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T00:59:54Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T00:59:54Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T00:59:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"40901c03c9dfa982e18fdab2bfa8c64d1bda5ffea180bcb1d04f77006e5715e7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T00:59:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"40901c03c9dfa982e18fdab2bfa8c64d1bda5ffea180bcb1d04f77006e5715e7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T00:59:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"40901c03c9dfa982e18fdab2bfa8c64d1bda5ffea180bcb1d04f77006e5715e7","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T00:59:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/40901c03c9dfa982e18fdab2bfa8c64d1bda5ffea180bcb1d04f77006e5715e7"}
{"level":"debug","ts":"2026-07-24T00:59:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"40901c03c9dfa982e18fdab2bfa8c64d1bda5ffea180bcb1d04f77006e5715e7","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T00:59:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/40901c03c9dfa982e18fdab2bfa8c64d1bda5ffea180bcb1d04f77006e5715e7"}
{"level":"debug","ts":"2026-07-24T00:59:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"40901c03c9dfa982e18fdab2bfa8c64d1bda5ffea180bcb1d04f77006e5715e7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T00:59:54Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T00:59:54Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["40901c03c9dfa982e18fdab2bfa8c64d1bda5ffea180bcb1d04f77006e5715e7"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T00:59:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"40901c03c9dfa982e18fdab2bfa8c64d1bda5ffea180bcb1d04f77006e5715e7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T00:59:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"40901c03c9dfa982e18fdab2bfa8c64d1bda5ffea180bcb1d04f77006e5715e7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T00:59:54Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T00:59:54Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T00:59:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"40901c03c9dfa982e18fdab2bfa8c64d1bda5ffea180bcb1d04f77006e5715e7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T00:59:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"40901c03c9dfa982e18fdab2bfa8c64d1bda5ffea180bcb1d04f77006e5715e7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T00:59:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"40901c03c9dfa982e18fdab2bfa8c64d1bda5ffea180bcb1d04f77006e5715e7","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T00:59:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/40901c03c9dfa982e18fdab2bfa8c64d1bda5ffea180bcb1d04f77006e5715e7"}
{"level":"debug","ts":"2026-07-24T00:59:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"40901c03c9dfa982e18fdab2bfa8c64d1bda5ffea180bcb1d04f77006e5715e7","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T00:59:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/40901c03c9dfa982e18fdab2bfa8c64d1bda5ffea180bcb1d04f77006e5715e7"}
{"level":"debug","ts":"2026-07-24T00:59:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"40901c03c9dfa982e18fdab2bfa8c64d1bda5ffea180bcb1d04f77006e5715e7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T00:59:54Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T00:59:54Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["40901c03c9dfa982e18fdab2bfa8c64d1bda5ffea180bcb1d04f77006e5715e7"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T00:59:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"40901c03c9dfa982e18fdab2bfa8c64d1bda5ffea180bcb1d04f77006e5715e7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T00:59:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"40901c03c9dfa982e18fdab2bfa8c64d1bda5ffea180bcb1d04f77006e5715e7","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T00:59:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/40901c03c9dfa982e18fdab2bfa8c64d1bda5ffea180bcb1d04f77006e5715e7"}
{"level":"debug","ts":"2026-07-24T00:59:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"90913ec327bd9d2c25c601917b9335480820e3638cc134ccf41ba401931dbfaa","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T00:59:54Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T00:59:54Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T00:59:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"90913ec327bd9d2c25c601917b9335480820e3638cc134ccf41ba401931dbfaa","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T00:59:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"90913ec327bd9d2c25c601917b9335480820e3638cc134ccf41ba401931dbfaa","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T00:59:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"90913ec327bd9d2c25c601917b9335480820e3638cc134ccf41ba401931dbfaa","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T00:59:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/90913ec327bd9d2c25c601917b9335480820e3638cc134ccf41ba401931dbfaa"}
{"level":"debug","ts":"2026-07-24T00:59:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"90913ec327bd9d2c25c601917b9335480820e3638cc134ccf41ba401931dbfaa","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T00:59:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/90913ec327bd9d2c25c601917b9335480820e3638cc134ccf41ba401931dbfaa"}
{"level":"debug","ts":"2026-07-24T00:59:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"90913ec327bd9d2c25c601917b9335480820e3638cc134ccf41ba401931dbfaa","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T00:59:55Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T00:59:55Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["90913ec327bd9d2c25c601917b9335480820e3638cc134ccf41ba401931dbfaa"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T00:59:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"90913ec327bd9d2c25c601917b9335480820e3638cc134ccf41ba401931dbfaa","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T00:59:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"90913ec327bd9d2c25c601917b9335480820e3638cc134ccf41ba401931dbfaa","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T00:59:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2c1bf7978bc463d7759ccbfc26cdef69bf2362e038492bab0010fe43e442306d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T00:59:55Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T00:59:55Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T00:59:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2c1bf7978bc463d7759ccbfc26cdef69bf2362e038492bab0010fe43e442306d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T00:59:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/90913ec327bd9d2c25c601917b9335480820e3638cc134ccf41ba401931dbfaa"}
{"level":"debug","ts":"2026-07-24T00:59:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2c1bf7978bc463d7759ccbfc26cdef69bf2362e038492bab0010fe43e442306d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T00:59:55Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T00:59:55Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T00:59:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2c1bf7978bc463d7759ccbfc26cdef69bf2362e038492bab0010fe43e442306d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T00:59:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2c1bf7978bc463d7759ccbfc26cdef69bf2362e038492bab0010fe43e442306d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T00:59:55Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T00:59:55Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"error","ts":"2026-07-24T00:59:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"2c1bf7978bc463d7759ccbfc26cdef69bf2362e038492bab0010fe43e442306d","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"2c1bf7978bc463d7759ccbfc26cdef69bf2362e038492bab0010fe43e442306d\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-24T00:59:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2c1bf7978bc463d7759ccbfc26cdef69bf2362e038492bab0010fe43e442306d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T00:59:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2c1bf7978bc463d7759ccbfc26cdef69bf2362e038492bab0010fe43e442306d"}
{"level":"debug","ts":"2026-07-24T00:59:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2c1bf7978bc463d7759ccbfc26cdef69bf2362e038492bab0010fe43e442306d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T00:59:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2c1bf7978bc463d7759ccbfc26cdef69bf2362e038492bab0010fe43e442306d"}
{"level":"debug","ts":"2026-07-24T00:59:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"84ddf98592ec7491d4cfd22b8b983a800fa671b6fe7d7e7ac5da9925b6cf9367","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T00:59:55Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T00:59:55Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T00:59:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"84ddf98592ec7491d4cfd22b8b983a800fa671b6fe7d7e7ac5da9925b6cf9367","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T00:59:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"84ddf98592ec7491d4cfd22b8b983a800fa671b6fe7d7e7ac5da9925b6cf9367","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T00:59:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2c1bf7978bc463d7759ccbfc26cdef69bf2362e038492bab0010fe43e442306d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T00:59:55Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T00:59:55Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["2c1bf7978bc463d7759ccbfc26cdef69bf2362e038492bab0010fe43e442306d"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T00:59:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/84ddf98592ec7491d4cfd22b8b983a800fa671b6fe7d7e7ac5da9925b6cf9367"}
{"level":"info","ts":"2026-07-24T00:59:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2c1bf7978bc463d7759ccbfc26cdef69bf2362e038492bab0010fe43e442306d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T00:59:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"84ddf98592ec7491d4cfd22b8b983a800fa671b6fe7d7e7ac5da9925b6cf9367","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T00:59:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2c1bf7978bc463d7759ccbfc26cdef69bf2362e038492bab0010fe43e442306d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T00:59:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/84ddf98592ec7491d4cfd22b8b983a800fa671b6fe7d7e7ac5da9925b6cf9367"}
{"level":"debug","ts":"2026-07-24T00:59:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"84ddf98592ec7491d4cfd22b8b983a800fa671b6fe7d7e7ac5da9925b6cf9367","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T00:59:55Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T00:59:55Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["84ddf98592ec7491d4cfd22b8b983a800fa671b6fe7d7e7ac5da9925b6cf9367"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T00:59:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2c1bf7978bc463d7759ccbfc26cdef69bf2362e038492bab0010fe43e442306d"}
{"level":"info","ts":"2026-07-24T00:59:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"84ddf98592ec7491d4cfd22b8b983a800fa671b6fe7d7e7ac5da9925b6cf9367","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T00:59:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"84ddf98592ec7491d4cfd22b8b983a800fa671b6fe7d7e7ac5da9925b6cf9367","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T00:59:55Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T00:59:55Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T00:59:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"84ddf98592ec7491d4cfd22b8b983a800fa671b6fe7d7e7ac5da9925b6cf9367","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T00:59:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"84ddf98592ec7491d4cfd22b8b983a800fa671b6fe7d7e7ac5da9925b6cf9367","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T00:59:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/84ddf98592ec7491d4cfd22b8b983a800fa671b6fe7d7e7ac5da9925b6cf9367"}
{"level":"debug","ts":"2026-07-24T00:59:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"84ddf98592ec7491d4cfd22b8b983a800fa671b6fe7d7e7ac5da9925b6cf9367","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T00:59:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b80b9f34269b2c2d86285625b7c9a4d9835d9c4bccd0d318f58c3a2f3c14a50d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T00:59:55Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T00:59:55Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T00:59:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/84ddf98592ec7491d4cfd22b8b983a800fa671b6fe7d7e7ac5da9925b6cf9367"}
{"level":"info","ts":"2026-07-24T00:59:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b80b9f34269b2c2d86285625b7c9a4d9835d9c4bccd0d318f58c3a2f3c14a50d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T00:59:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"84ddf98592ec7491d4cfd22b8b983a800fa671b6fe7d7e7ac5da9925b6cf9367","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T00:59:55Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T00:59:55Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["84ddf98592ec7491d4cfd22b8b983a800fa671b6fe7d7e7ac5da9925b6cf9367"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T00:59:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"84ddf98592ec7491d4cfd22b8b983a800fa671b6fe7d7e7ac5da9925b6cf9367","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T00:59:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b80b9f34269b2c2d86285625b7c9a4d9835d9c4bccd0d318f58c3a2f3c14a50d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T00:59:55Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T00:59:55Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T00:59:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b80b9f34269b2c2d86285625b7c9a4d9835d9c4bccd0d318f58c3a2f3c14a50d"}
{"level":"info","ts":"2026-07-24T00:59:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b80b9f34269b2c2d86285625b7c9a4d9835d9c4bccd0d318f58c3a2f3c14a50d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T00:59:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"84ddf98592ec7491d4cfd22b8b983a800fa671b6fe7d7e7ac5da9925b6cf9367","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T00:59:55Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T00:59:55Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T00:59:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/84ddf98592ec7491d4cfd22b8b983a800fa671b6fe7d7e7ac5da9925b6cf9367"}
{"level":"info","ts":"2026-07-24T00:59:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"84ddf98592ec7491d4cfd22b8b983a800fa671b6fe7d7e7ac5da9925b6cf9367","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T00:59:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b80b9f34269b2c2d86285625b7c9a4d9835d9c4bccd0d318f58c3a2f3c14a50d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T00:59:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"84ddf98592ec7491d4cfd22b8b983a800fa671b6fe7d7e7ac5da9925b6cf9367","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T00:59:55Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T00:59:55Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["84ddf98592ec7491d4cfd22b8b983a800fa671b6fe7d7e7ac5da9925b6cf9367"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T00:59:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"84ddf98592ec7491d4cfd22b8b983a800fa671b6fe7d7e7ac5da9925b6cf9367","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T00:59:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"84ddf98592ec7491d4cfd22b8b983a800fa671b6fe7d7e7ac5da9925b6cf9367","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T00:59:55Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T00:59:55Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["84ddf98592ec7491d4cfd22b8b983a800fa671b6fe7d7e7ac5da9925b6cf9367"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T00:59:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b80b9f34269b2c2d86285625b7c9a4d9835d9c4bccd0d318f58c3a2f3c14a50d"}
{"level":"error","ts":"2026-07-24T00:59:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"84ddf98592ec7491d4cfd22b8b983a800fa671b6fe7d7e7ac5da9925b6cf9367","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"84ddf98592ec7491d4cfd22b8b983a800fa671b6fe7d7e7ac5da9925b6cf9367\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-24T00:59:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b80b9f34269b2c2d86285625b7c9a4d9835d9c4bccd0d318f58c3a2f3c14a50d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T00:59:55Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T00:59:55Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["b80b9f34269b2c2d86285625b7c9a4d9835d9c4bccd0d318f58c3a2f3c14a50d"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T00:59:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b80b9f34269b2c2d86285625b7c9a4d9835d9c4bccd0d318f58c3a2f3c14a50d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T00:59:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"84ddf98592ec7491d4cfd22b8b983a800fa671b6fe7d7e7ac5da9925b6cf9367","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T00:59:55Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T00:59:55Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T00:59:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/84ddf98592ec7491d4cfd22b8b983a800fa671b6fe7d7e7ac5da9925b6cf9367"}
{"level":"info","ts":"2026-07-24T00:59:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"84ddf98592ec7491d4cfd22b8b983a800fa671b6fe7d7e7ac5da9925b6cf9367","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T00:59:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b80b9f34269b2c2d86285625b7c9a4d9835d9c4bccd0d318f58c3a2f3c14a50d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T00:59:55Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T00:59:55Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T00:59:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b80b9f34269b2c2d86285625b7c9a4d9835d9c4bccd0d318f58c3a2f3c14a50d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T00:59:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f287c334994a96bb636cfe8789ccf29bd6cafe64c531871b4cbaed3ca850c14f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T00:59:55Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T00:59:55Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T00:59:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b80b9f34269b2c2d86285625b7c9a4d9835d9c4bccd0d318f58c3a2f3c14a50d"}
{"level":"info","ts":"2026-07-24T00:59:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f287c334994a96bb636cfe8789ccf29bd6cafe64c531871b4cbaed3ca850c14f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T00:59:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"84ddf98592ec7491d4cfd22b8b983a800fa671b6fe7d7e7ac5da9925b6cf9367","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T00:59:55Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T00:59:55Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["84ddf98592ec7491d4cfd22b8b983a800fa671b6fe7d7e7ac5da9925b6cf9367"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T00:59:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f287c334994a96bb636cfe8789ccf29bd6cafe64c531871b4cbaed3ca850c14f"}
{"level":"info","ts":"2026-07-24T00:59:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"84ddf98592ec7491d4cfd22b8b983a800fa671b6fe7d7e7ac5da9925b6cf9367","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T00:59:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b80b9f34269b2c2d86285625b7c9a4d9835d9c4bccd0d318f58c3a2f3c14a50d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T00:59:55Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T00:59:55Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["b80b9f34269b2c2d86285625b7c9a4d9835d9c4bccd0d318f58c3a2f3c14a50d"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T00:59:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b80b9f34269b2c2d86285625b7c9a4d9835d9c4bccd0d318f58c3a2f3c14a50d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T00:59:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f287c334994a96bb636cfe8789ccf29bd6cafe64c531871b4cbaed3ca850c14f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T00:59:55Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T00:59:55Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["f287c334994a96bb636cfe8789ccf29bd6cafe64c531871b4cbaed3ca850c14f"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T00:59:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/84ddf98592ec7491d4cfd22b8b983a800fa671b6fe7d7e7ac5da9925b6cf9367"}
{"level":"info","ts":"2026-07-24T00:59:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f287c334994a96bb636cfe8789ccf29bd6cafe64c531871b4cbaed3ca850c14f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T00:59:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"84ddf98592ec7491d4cfd22b8b983a800fa671b6fe7d7e7ac5da9925b6cf9367","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T00:59:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b80b9f34269b2c2d86285625b7c9a4d9835d9c4bccd0d318f58c3a2f3c14a50d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T00:59:55Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T00:59:55Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T00:59:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b80b9f34269b2c2d86285625b7c9a4d9835d9c4bccd0d318f58c3a2f3c14a50d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T00:59:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f287c334994a96bb636cfe8789ccf29bd6cafe64c531871b4cbaed3ca850c14f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T00:59:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b80b9f34269b2c2d86285625b7c9a4d9835d9c4bccd0d318f58c3a2f3c14a50d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T00:59:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b80b9f34269b2c2d86285625b7c9a4d9835d9c4bccd0d318f58c3a2f3c14a50d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T00:59:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b80b9f34269b2c2d86285625b7c9a4d9835d9c4bccd0d318f58c3a2f3c14a50d"}
{"level":"debug","ts":"2026-07-24T00:59:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6d7860a764a60859f863f336a074ccbe70976720255de97d370a631b05830e66","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T00:59:55Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T00:59:55Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T00:59:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6d7860a764a60859f863f336a074ccbe70976720255de97d370a631b05830e66","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T00:59:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b80b9f34269b2c2d86285625b7c9a4d9835d9c4bccd0d318f58c3a2f3c14a50d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T00:59:55Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T00:59:55Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["b80b9f34269b2c2d86285625b7c9a4d9835d9c4bccd0d318f58c3a2f3c14a50d"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T00:59:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b80b9f34269b2c2d86285625b7c9a4d9835d9c4bccd0d318f58c3a2f3c14a50d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T00:59:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"deff17dad2ae36bd0cc0f19d8a8a152a97eea766cf29f1ca7f986b28fc7e4b5a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T00:59:55Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T00:59:55Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T00:59:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f287c334994a96bb636cfe8789ccf29bd6cafe64c531871b4cbaed3ca850c14f"}
{"level":"info","ts":"2026-07-24T00:59:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"deff17dad2ae36bd0cc0f19d8a8a152a97eea766cf29f1ca7f986b28fc7e4b5a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T00:59:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6d7860a764a60859f863f336a074ccbe70976720255de97d370a631b05830e66","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T00:59:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b80b9f34269b2c2d86285625b7c9a4d9835d9c4bccd0d318f58c3a2f3c14a50d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T00:59:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"deff17dad2ae36bd0cc0f19d8a8a152a97eea766cf29f1ca7f986b28fc7e4b5a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T00:59:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"deff17dad2ae36bd0cc0f19d8a8a152a97eea766cf29f1ca7f986b28fc7e4b5a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T00:59:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6d7860a764a60859f863f336a074ccbe70976720255de97d370a631b05830e66","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T00:59:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/84ddf98592ec7491d4cfd22b8b983a800fa671b6fe7d7e7ac5da9925b6cf9367"}
{"level":"debug","ts":"2026-07-24T00:59:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"deff17dad2ae36bd0cc0f19d8a8a152a97eea766cf29f1ca7f986b28fc7e4b5a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T00:59:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6d7860a764a60859f863f336a074ccbe70976720255de97d370a631b05830e66","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T00:59:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b80b9f34269b2c2d86285625b7c9a4d9835d9c4bccd0d318f58c3a2f3c14a50d"}
{"level":"debug","ts":"2026-07-24T00:59:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ec1775b4386fa8c704b612984f68d1858bc6c372edbe0b6ac95dddb9d536ec32","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T00:59:55Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T00:59:55Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T00:59:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6d7860a764a60859f863f336a074ccbe70976720255de97d370a631b05830e66"}
{"level":"info","ts":"2026-07-24T00:59:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ec1775b4386fa8c704b612984f68d1858bc6c372edbe0b6ac95dddb9d536ec32","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T00:59:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"deff17dad2ae36bd0cc0f19d8a8a152a97eea766cf29f1ca7f986b28fc7e4b5a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T00:59:55Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T00:59:55Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T00:59:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"deff17dad2ae36bd0cc0f19d8a8a152a97eea766cf29f1ca7f986b28fc7e4b5a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T00:59:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6d7860a764a60859f863f336a074ccbe70976720255de97d370a631b05830e66","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T00:59:55Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T00:59:55Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["6d7860a764a60859f863f336a074ccbe70976720255de97d370a631b05830e66"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T00:59:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/deff17dad2ae36bd0cc0f19d8a8a152a97eea766cf29f1ca7f986b28fc7e4b5a"}
{"level":"info","ts":"2026-07-24T00:59:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6d7860a764a60859f863f336a074ccbe70976720255de97d370a631b05830e66","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T00:59:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ec1775b4386fa8c704b612984f68d1858bc6c372edbe0b6ac95dddb9d536ec32","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T00:59:55Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T00:59:55Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T00:59:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ec1775b4386fa8c704b612984f68d1858bc6c372edbe0b6ac95dddb9d536ec32","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T00:59:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e3429122a612a05175edfd8157117e7f5e753560d8497fdf818b4d85e0c1e027","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T00:59:55Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T00:59:55Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T00:59:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ec1775b4386fa8c704b612984f68d1858bc6c372edbe0b6ac95dddb9d536ec32"}
{"level":"info","ts":"2026-07-24T00:59:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e3429122a612a05175edfd8157117e7f5e753560d8497fdf818b4d85e0c1e027","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T00:59:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"deff17dad2ae36bd0cc0f19d8a8a152a97eea766cf29f1ca7f986b28fc7e4b5a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T00:59:55Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T00:59:55Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["deff17dad2ae36bd0cc0f19d8a8a152a97eea766cf29f1ca7f986b28fc7e4b5a"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T00:59:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"deff17dad2ae36bd0cc0f19d8a8a152a97eea766cf29f1ca7f986b28fc7e4b5a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T00:59:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6d7860a764a60859f863f336a074ccbe70976720255de97d370a631b05830e66","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T00:59:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ec1775b4386fa8c704b612984f68d1858bc6c372edbe0b6ac95dddb9d536ec32","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T00:59:55Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T00:59:55Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["ec1775b4386fa8c704b612984f68d1858bc6c372edbe0b6ac95dddb9d536ec32"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T00:59:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e3429122a612a05175edfd8157117e7f5e753560d8497fdf818b4d85e0c1e027"}
{"level":"info","ts":"2026-07-24T00:59:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ec1775b4386fa8c704b612984f68d1858bc6c372edbe0b6ac95dddb9d536ec32","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T00:59:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e3429122a612a05175edfd8157117e7f5e753560d8497fdf818b4d85e0c1e027","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T00:59:55Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T00:59:55Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["e3429122a612a05175edfd8157117e7f5e753560d8497fdf818b4d85e0c1e027"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T00:59:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e3429122a612a05175edfd8157117e7f5e753560d8497fdf818b4d85e0c1e027","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T00:59:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"deff17dad2ae36bd0cc0f19d8a8a152a97eea766cf29f1ca7f986b28fc7e4b5a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T00:59:55Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T00:59:55Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T00:59:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/deff17dad2ae36bd0cc0f19d8a8a152a97eea766cf29f1ca7f986b28fc7e4b5a"}
{"level":"info","ts":"2026-07-24T00:59:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"deff17dad2ae36bd0cc0f19d8a8a152a97eea766cf29f1ca7f986b28fc7e4b5a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T00:59:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d04d1b3e5a872211f56f568eecdd2484ed0e93e4e199ebc79605403bda60fd21","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T00:59:55Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T00:59:55Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T00:59:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d04d1b3e5a872211f56f568eecdd2484ed0e93e4e199ebc79605403bda60fd21","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T00:59:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ec1775b4386fa8c704b612984f68d1858bc6c372edbe0b6ac95dddb9d536ec32","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T00:59:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"180e92a4f72a25e019a957c3b02bd88c904cf72ac79b8adf8ab3f3c7756a7fc9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-24T00:59:55Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-24T00:59:55Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T00:59:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6d7860a764a60859f863f336a074ccbe70976720255de97d370a631b05830e66"}
{"level":"info","ts":"2026-07-24T00:59:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"180e92a4f72a25e019a957c3b02bd88c904cf72ac79b8adf8ab3f3c7756a7fc9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T00:59:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e3429122a612a05175edfd8157117e7f5e753560d8497fdf818b4d85e0c1e027","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T00:59:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"deff17dad2ae36bd0cc0f19d8a8a152a97eea766cf29f1ca7f986b28fc7e4b5a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T00:59:55Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T00:59:55Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["deff17dad2ae36bd0cc0f19d8a8a152a97eea766cf29f1ca7f986b28fc7e4b5a"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T00:59:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"deff17dad2ae36bd0cc0f19d8a8a152a97eea766cf29f1ca7f986b28fc7e4b5a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T00:59:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d04d1b3e5a872211f56f568eecdd2484ed0e93e4e199ebc79605403bda60fd21","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T00:59:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"180e92a4f72a25e019a957c3b02bd88c904cf72ac79b8adf8ab3f3c7756a7fc9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T00:59:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"deff17dad2ae36bd0cc0f19d8a8a152a97eea766cf29f1ca7f986b28fc7e4b5a","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T00:59:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ec1775b4386fa8c704b612984f68d1858bc6c372edbe0b6ac95dddb9d536ec32"}
{"level":"debug","ts":"2026-07-24T00:59:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d04d1b3e5a872211f56f568eecdd2484ed0e93e4e199ebc79605403bda60fd21","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T00:59:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"180e92a4f72a25e019a957c3b02bd88c904cf72ac79b8adf8ab3f3c7756a7fc9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T00:59:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d04d1b3e5a872211f56f568eecdd2484ed0e93e4e199ebc79605403bda60fd21","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T00:59:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"180e92a4f72a25e019a957c3b02bd88c904cf72ac79b8adf8ab3f3c7756a7fc9","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T00:59:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e3429122a612a05175edfd8157117e7f5e753560d8497fdf818b4d85e0c1e027"}
{"level":"info","ts":"2026-07-24T00:59:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d04d1b3e5a872211f56f568eecdd2484ed0e93e4e199ebc79605403bda60fd21"}
{"level":"debug","ts":"2026-07-24T00:59:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d04d1b3e5a872211f56f568eecdd2484ed0e93e4e199ebc79605403bda60fd21","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T00:59:55Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T00:59:55Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["d04d1b3e5a872211f56f568eecdd2484ed0e93e4e199ebc79605403bda60fd21"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T00:59:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/180e92a4f72a25e019a957c3b02bd88c904cf72ac79b8adf8ab3f3c7756a7fc9"}
{"level":"info","ts":"2026-07-24T00:59:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d04d1b3e5a872211f56f568eecdd2484ed0e93e4e199ebc79605403bda60fd21","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T00:59:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"180e92a4f72a25e019a957c3b02bd88c904cf72ac79b8adf8ab3f3c7756a7fc9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-24T00:59:55Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-24T00:59:55Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["180e92a4f72a25e019a957c3b02bd88c904cf72ac79b8adf8ab3f3c7756a7fc9"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-24T00:59:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"180e92a4f72a25e019a957c3b02bd88c904cf72ac79b8adf8ab3f3c7756a7fc9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T00:59:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d04d1b3e5a872211f56f568eecdd2484ed0e93e4e199ebc79605403bda60fd21","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-24T00:59:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"180e92a4f72a25e019a957c3b02bd88c904cf72ac79b8adf8ab3f3c7756a7fc9","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-24T00:59:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/deff17dad2ae36bd0cc0f19d8a8a152a97eea766cf29f1ca7f986b28fc7e4b5a"}
{"level":"info","ts":"2026-07-24T00:59:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d04d1b3e5a872211f56f568eecdd2484ed0e93e4e199ebc79605403bda60fd21"}
{"level":"info","ts":"2026-07-24T00:59:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/180e92a4f72a25e019a957c3b02bd88c904cf72ac79b8adf8ab3f3c7756a7fc9"}
{"level":"info","ts":"2026-07-24T01:00:00Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7d595aa9-7558-4bc0-86bb-36df599e1f1a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.10:38326","PortSpecifier":{"PortValue":38326}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.73:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"7d595aa9-7558-4bc0-86bb-36df599e1f1a","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-ipp-a-a3cf0e.apps.08e98f4e-5bc6-4a15-8c99-991d7235bd49.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T01:00:00Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7d595aa9-7558-4bc0-86bb-36df599e1f1a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.10:38326","PortSpecifier":{"PortValue":38326}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.73:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784854800,"nanos":344274731},"http":{"id":"7d595aa9-7558-4bc0-86bb-36df599e1f1a","method":"POST","headers":{":authority":"e2e-ipp-a-a3cf0e.apps.08e98f4e-5bc6-4a15-8c99-991d7235bd49.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T01:00:00Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"7d595aa9-7558-4bc0-86bb-36df599e1f1a","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-24T01:00:00Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"7d595aa9-7558-4bc0-86bb-36df599e1f1a","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"001ff030-ee9f-4e4a-8c3f-81e970dac168","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=fc707eb4-0a4a-4f24-aaba-02ba27004cae"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/991d7235bd49"]}}
{"level":"debug","ts":"2026-07-24T01:00:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"7d595aa9-7558-4bc0-86bb-36df599e1f1a","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/991d7235bd49"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=fc707eb4-0a4a-4f24-aaba-02ba27004cae"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"001ff030-ee9f-4e4a-8c3f-81e970dac168","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"6d7860a764a60859f863f336a074ccbe70976720255de97d370a631b05830e66"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.73:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-ipp-a-a3cf0e.apps.08e98f4e-5bc6-4a15-8c99-991d7235bd49.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T01:00:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7d595aa9-7558-4bc0-86bb-36df599e1f1a","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T01:00:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7d595aa9-7558-4bc0-86bb-36df599e1f1a","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-ipp-a-a3cf0e/ipp-route-a3cf0e\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-ipp-a-a3cf0e/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T01:00:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7d595aa9-7558-4bc0-86bb-36df599e1f1a","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T01:00:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"7d595aa9-7558-4bc0-86bb-36df599e1f1a","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-24T01:00:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7d595aa9-7558-4bc0-86bb-36df599e1f1a","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T01:00:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7d595aa9-7558-4bc0-86bb-36df599e1f1a","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-24T01:00:00Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7d595aa9-7558-4bc0-86bb-36df599e1f1a","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T01:00:00Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7d595aa9-7558-4bc0-86bb-36df599e1f1a","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T01:00:02Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3f456c51-2512-47cc-85cd-d0409ba73d1c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.10:38340","PortSpecifier":{"PortValue":38340}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.73:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"3f456c51-2512-47cc-85cd-d0409ba73d1c","method":"POST","path":"/ai-tenant-e2e-ipp-a-a3cf0e/ipp-route-a3cf0e/v1/chat/completions","host":"e2e-ipp-a-a3cf0e.apps.08e98f4e-5bc6-4a15-8c99-991d7235bd49.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-24T01:00:02Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3f456c51-2512-47cc-85cd-d0409ba73d1c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.10:38340","PortSpecifier":{"PortValue":38340}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.73:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784854802,"nanos":426877470},"http":{"id":"3f456c51-2512-47cc-85cd-d0409ba73d1c","method":"POST","headers":{":authority":"e2e-ipp-a-a3cf0e.apps.08e98f4e-5bc6-4a15-8c99-991d7235bd49.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-ipp-a-a3cf0e/ipp-route-a3cf0e/v1/chat/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T01:00:02Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"3f456c51-2512-47cc-85cd-d0409ba73d1c","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1YZTvkOH1haxCDR9l_DId6lMRvn5DQwRevHxVPQA81GXD0NAWTun1CCTwxfVI"}
{"level":"debug","ts":"2026-07-24T01:00:02Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"3f456c51-2512-47cc-85cd-d0409ba73d1c","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-ipp-a-a3cf0e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1YZTvkOH1haxCDR9l_DId6lMRvn5DQwRevHxVPQA81GXD0NAWTun1CCTwxfVI\"}"}
{"level":"debug","ts":"2026-07-24T01:00:02Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"3f456c51-2512-47cc-85cd-d0409ba73d1c","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-ipp-a-a3cf0e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"41153245-1309-4b6a-8d06-0c686e8bc9c7","keyName":"e2e-ipp-a3cf0e","subscription":"ipp-route-a3cf0e-sub","tenant":"e2e-ipp-a-a3cf0e","userId":"41153245-1309-4b6a-8d06-0c686e8bc9c7","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-24T01:00:02Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"3f456c51-2512-47cc-85cd-d0409ba73d1c","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-ipp-a-a3cf0e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-ipp-a-a3cf0e/ipp-route-a3cf0e\",\"requestedSubscription\":\"ipp-route-a3cf0e-sub\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-24T01:00:02Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"3f456c51-2512-47cc-85cd-d0409ba73d1c","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-ipp-a-a3cf0e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"ipp-route-a3cf0e","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"ipp-route-a3cf0e-sub","namespace":"ai-tenant-e2e-ipp-a-a3cf0e","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-ipp-a-a3cf0e/ipp-route-a3cf0e"}}
{"level":"debug","ts":"2026-07-24T01:00:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"3f456c51-2512-47cc-85cd-d0409ba73d1c","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-24T01:00:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3f456c51-2512-47cc-85cd-d0409ba73d1c","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T01:00:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3f456c51-2512-47cc-85cd-d0409ba73d1c","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T01:00:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3f456c51-2512-47cc-85cd-d0409ba73d1c","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-ipp-a-a3cf0e/ipp-route-a3cf0e\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-ipp-a-a3cf0e/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T01:00:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3f456c51-2512-47cc-85cd-d0409ba73d1c","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-24T01:00:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3f456c51-2512-47cc-85cd-d0409ba73d1c","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"ipp-route-a3cf0e-sub"}
{"level":"debug","ts":"2026-07-24T01:00:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3f456c51-2512-47cc-85cd-d0409ba73d1c","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-24T01:00:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3f456c51-2512-47cc-85cd-d0409ba73d1c","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-24T01:00:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3f456c51-2512-47cc-85cd-d0409ba73d1c","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"41153245-1309-4b6a-8d06-0c686e8bc9c7","keyName":"e2e-ipp-a3cf0e","selected_subscription":"ipp-route-a3cf0e-sub","selected_subscription_key":"ai-tenant-e2e-ipp-a-a3cf0e/ipp-route-a3cf0e-sub@ai-tenant-e2e-ipp-a-a3cf0e/ipp-route-a3cf0e","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"ipp-route-a3cf0e","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"ipp-route-a3cf0e-sub","namespace":"ai-tenant-e2e-ipp-a-a3cf0e","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-ipp-a-a3cf0e/ipp-route-a3cf0e"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-24T01:00:02Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3f456c51-2512-47cc-85cd-d0409ba73d1c","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-24T01:00:02Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3f456c51-2512-47cc-85cd-d0409ba73d1c","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-24T01:01:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/40901c03c9dfa982e18fdab2bfa8c64d1bda5ffea180bcb1d04f77006e5715e7"}
{"level":"info","ts":"2026-07-24T01:01:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/b80b9f34269b2c2d86285625b7c9a4d9835d9c4bccd0d318f58c3a2f3c14a50d"}
{"level":"info","ts":"2026-07-24T01:01:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/90913ec327bd9d2c25c601917b9335480820e3638cc134ccf41ba401931dbfaa"}
{"level":"info","ts":"2026-07-24T01:01:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/2c1bf7978bc463d7759ccbfc26cdef69bf2362e038492bab0010fe43e442306d"}
{"level":"info","ts":"2026-07-24T01:01:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/6d7860a764a60859f863f336a074ccbe70976720255de97d370a631b05830e66"}
{"level":"info","ts":"2026-07-24T01:01:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/ec1775b4386fa8c704b612984f68d1858bc6c372edbe0b6ac95dddb9d536ec32"}
{"level":"info","ts":"2026-07-24T01:01:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/d04d1b3e5a872211f56f568eecdd2484ed0e93e4e199ebc79605403bda60fd21"}
{"level":"info","ts":"2026-07-24T01:01:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/180e92a4f72a25e019a957c3b02bd88c904cf72ac79b8adf8ab3f3c7756a7fc9"}
{"level":"info","ts":"2026-07-24T01:01:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/f287c334994a96bb636cfe8789ccf29bd6cafe64c531871b4cbaed3ca850c14f"}
{"level":"info","ts":"2026-07-24T01:01:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/deff17dad2ae36bd0cc0f19d8a8a152a97eea766cf29f1ca7f986b28fc7e4b5a"}
{"level":"info","ts":"2026-07-24T01:01:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/e3429122a612a05175edfd8157117e7f5e753560d8497fdf818b4d85e0c1e027"}
{"level":"info","ts":"2026-07-24T01:01:03Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/84ddf98592ec7491d4cfd22b8b983a800fa671b6fe7d7e7ac5da9925b6cf9367"}