--- Authorino logs from kuadrant-system (label=authorino-resource=authorino) ---
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"477dec55-f754-400a-bfdc-e1eceddbd3e6","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:maas-admin:tester-admin-user"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"477dec55-f754-400a-bfdc-e1eceddbd3e6","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"477dec55-f754-400a-bfdc-e1eceddbd3e6","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:maas-admin\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"477dec55-f754-400a-bfdc-e1eceddbd3e6","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"477dec55-f754-400a-bfdc-e1eceddbd3e6","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0c8d8a4c-26af-412c-9be5-bd3851c78b24","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:50938","PortSpecifier":{"PortValue":50938}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"0c8d8a4c-26af-412c-9be5-bd3851c78b24","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0c8d8a4c-26af-412c-9be5-bd3851c78b24","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:50938","PortSpecifier":{"PortValue":50938}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442196,"nanos":53799311},"http":{"id":"0c8d8a4c-26af-412c-9be5-bd3851c78b24","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"0c8d8a4c-26af-412c-9be5-bd3851c78b24","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"0c8d8a4c-26af-412c-9be5-bd3851c78b24","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"0c8d8a4c-26af-412c-9be5-bd3851c78b24","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"0c8d8a4c-26af-412c-9be5-bd3851c78b24","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"0c8d8a4c-26af-412c-9be5-bd3851c78b24"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"0c8d8a4c-26af-412c-9be5-bd3851c78b24","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":53799311,"seconds":1783442196}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":50938},"address":"10.133.0.32:50938"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0c8d8a4c-26af-412c-9be5-bd3851c78b24","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0c8d8a4c-26af-412c-9be5-bd3851c78b24","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0c8d8a4c-26af-412c-9be5-bd3851c78b24","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0c8d8a4c-26af-412c-9be5-bd3851c78b24","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:maas-admin:tester-admin-user"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"0c8d8a4c-26af-412c-9be5-bd3851c78b24","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0c8d8a4c-26af-412c-9be5-bd3851c78b24","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0c8d8a4c-26af-412c-9be5-bd3851c78b24","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:maas-admin\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0c8d8a4c-26af-412c-9be5-bd3851c78b24","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0c8d8a4c-26af-412c-9be5-bd3851c78b24","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"83d681c1-91f7-4c66-b572-698d83dc0c26","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:50946","PortSpecifier":{"PortValue":50946}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"83d681c1-91f7-4c66-b572-698d83dc0c26","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"83d681c1-91f7-4c66-b572-698d83dc0c26","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:50946","PortSpecifier":{"PortValue":50946}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442196,"nanos":65707863},"http":{"id":"83d681c1-91f7-4c66-b572-698d83dc0c26","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"83d681c1-91f7-4c66-b572-698d83dc0c26","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"83d681c1-91f7-4c66-b572-698d83dc0c26","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"83d681c1-91f7-4c66-b572-698d83dc0c26","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"83d681c1-91f7-4c66-b572-698d83dc0c26","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"83d681c1-91f7-4c66-b572-698d83dc0c26"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"83d681c1-91f7-4c66-b572-698d83dc0c26","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":65707863,"seconds":1783442196}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":50946},"address":"10.133.0.32:50946"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"83d681c1-91f7-4c66-b572-698d83dc0c26","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"83d681c1-91f7-4c66-b572-698d83dc0c26","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"83d681c1-91f7-4c66-b572-698d83dc0c26","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"83d681c1-91f7-4c66-b572-698d83dc0c26","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"83d681c1-91f7-4c66-b572-698d83dc0c26","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"83d681c1-91f7-4c66-b572-698d83dc0c26","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:maas-admin\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"83d681c1-91f7-4c66-b572-698d83dc0c26","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:maas-admin:tester-admin-user"}
{"level":"info","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"83d681c1-91f7-4c66-b572-698d83dc0c26","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"83d681c1-91f7-4c66-b572-698d83dc0c26","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5f4a041a-47e8-4116-b08e-8a56afec2d48","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:50952","PortSpecifier":{"PortValue":50952}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"5f4a041a-47e8-4116-b08e-8a56afec2d48","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5f4a041a-47e8-4116-b08e-8a56afec2d48","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:50952","PortSpecifier":{"PortValue":50952}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442196,"nanos":97813817},"http":{"id":"5f4a041a-47e8-4116-b08e-8a56afec2d48","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"5f4a041a-47e8-4116-b08e-8a56afec2d48","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"5f4a041a-47e8-4116-b08e-8a56afec2d48","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"5f4a041a-47e8-4116-b08e-8a56afec2d48","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"5f4a041a-47e8-4116-b08e-8a56afec2d48","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"5f4a041a-47e8-4116-b08e-8a56afec2d48"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"5f4a041a-47e8-4116-b08e-8a56afec2d48","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":97813817,"seconds":1783442196}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":50952},"address":"10.133.0.32:50952"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5f4a041a-47e8-4116-b08e-8a56afec2d48","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5f4a041a-47e8-4116-b08e-8a56afec2d48","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5f4a041a-47e8-4116-b08e-8a56afec2d48","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5f4a041a-47e8-4116-b08e-8a56afec2d48","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:maas-admin\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"5f4a041a-47e8-4116-b08e-8a56afec2d48","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5f4a041a-47e8-4116-b08e-8a56afec2d48","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5f4a041a-47e8-4116-b08e-8a56afec2d48","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:maas-admin:tester-admin-user"}
{"level":"info","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5f4a041a-47e8-4116-b08e-8a56afec2d48","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5f4a041a-47e8-4116-b08e-8a56afec2d48","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e16f4f5f-7f74-49eb-a869-1e4095e0f5ca","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:50964","PortSpecifier":{"PortValue":50964}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"e16f4f5f-7f74-49eb-a869-1e4095e0f5ca","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e16f4f5f-7f74-49eb-a869-1e4095e0f5ca","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:50964","PortSpecifier":{"PortValue":50964}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442196,"nanos":110351306},"http":{"id":"e16f4f5f-7f74-49eb-a869-1e4095e0f5ca","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"e16f4f5f-7f74-49eb-a869-1e4095e0f5ca","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"e16f4f5f-7f74-49eb-a869-1e4095e0f5ca","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"e16f4f5f-7f74-49eb-a869-1e4095e0f5ca","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"e16f4f5f-7f74-49eb-a869-1e4095e0f5ca","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"e16f4f5f-7f74-49eb-a869-1e4095e0f5ca"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"e16f4f5f-7f74-49eb-a869-1e4095e0f5ca","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":110351306,"seconds":1783442196}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":50964},"address":"10.133.0.32:50964"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e16f4f5f-7f74-49eb-a869-1e4095e0f5ca","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e16f4f5f-7f74-49eb-a869-1e4095e0f5ca","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e16f4f5f-7f74-49eb-a869-1e4095e0f5ca","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"e16f4f5f-7f74-49eb-a869-1e4095e0f5ca","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e16f4f5f-7f74-49eb-a869-1e4095e0f5ca","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:maas-admin:tester-admin-user"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e16f4f5f-7f74-49eb-a869-1e4095e0f5ca","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e16f4f5f-7f74-49eb-a869-1e4095e0f5ca","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:maas-admin\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e16f4f5f-7f74-49eb-a869-1e4095e0f5ca","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e16f4f5f-7f74-49eb-a869-1e4095e0f5ca","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"07d9138b-c209-4038-8157-77f7b900f72a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:50972","PortSpecifier":{"PortValue":50972}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"07d9138b-c209-4038-8157-77f7b900f72a","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"07d9138b-c209-4038-8157-77f7b900f72a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:50972","PortSpecifier":{"PortValue":50972}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442196,"nanos":122716174},"http":{"id":"07d9138b-c209-4038-8157-77f7b900f72a","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"07d9138b-c209-4038-8157-77f7b900f72a","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"07d9138b-c209-4038-8157-77f7b900f72a","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"07d9138b-c209-4038-8157-77f7b900f72a","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"07d9138b-c209-4038-8157-77f7b900f72a","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"07d9138b-c209-4038-8157-77f7b900f72a"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"07d9138b-c209-4038-8157-77f7b900f72a","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":122716174,"seconds":1783442196}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":50972},"address":"10.133.0.32:50972"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"07d9138b-c209-4038-8157-77f7b900f72a","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"07d9138b-c209-4038-8157-77f7b900f72a","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"07d9138b-c209-4038-8157-77f7b900f72a","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"07d9138b-c209-4038-8157-77f7b900f72a","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:maas-admin:tester-admin-user"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"07d9138b-c209-4038-8157-77f7b900f72a","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"07d9138b-c209-4038-8157-77f7b900f72a","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"07d9138b-c209-4038-8157-77f7b900f72a","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:maas-admin\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"07d9138b-c209-4038-8157-77f7b900f72a","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"07d9138b-c209-4038-8157-77f7b900f72a","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1a1ec6cb-222a-48c7-b5c4-b739ee2fc4c5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:50984","PortSpecifier":{"PortValue":50984}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"1a1ec6cb-222a-48c7-b5c4-b739ee2fc4c5","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1a1ec6cb-222a-48c7-b5c4-b739ee2fc4c5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:50984","PortSpecifier":{"PortValue":50984}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442196,"nanos":134787134},"http":{"id":"1a1ec6cb-222a-48c7-b5c4-b739ee2fc4c5","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"1a1ec6cb-222a-48c7-b5c4-b739ee2fc4c5","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"1a1ec6cb-222a-48c7-b5c4-b739ee2fc4c5","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"1a1ec6cb-222a-48c7-b5c4-b739ee2fc4c5","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"1a1ec6cb-222a-48c7-b5c4-b739ee2fc4c5","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"1a1ec6cb-222a-48c7-b5c4-b739ee2fc4c5"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"1a1ec6cb-222a-48c7-b5c4-b739ee2fc4c5","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":134787134,"seconds":1783442196}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":50984},"address":"10.133.0.32:50984"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1a1ec6cb-222a-48c7-b5c4-b739ee2fc4c5","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1a1ec6cb-222a-48c7-b5c4-b739ee2fc4c5","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1a1ec6cb-222a-48c7-b5c4-b739ee2fc4c5","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1a1ec6cb-222a-48c7-b5c4-b739ee2fc4c5","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:maas-admin:tester-admin-user"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"1a1ec6cb-222a-48c7-b5c4-b739ee2fc4c5","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1a1ec6cb-222a-48c7-b5c4-b739ee2fc4c5","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:maas-admin\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1a1ec6cb-222a-48c7-b5c4-b739ee2fc4c5","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1a1ec6cb-222a-48c7-b5c4-b739ee2fc4c5","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1a1ec6cb-222a-48c7-b5c4-b739ee2fc4c5","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ce3b5984-2169-4f4a-b3fc-0dc8cefac8fb","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:50986","PortSpecifier":{"PortValue":50986}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"ce3b5984-2169-4f4a-b3fc-0dc8cefac8fb","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ce3b5984-2169-4f4a-b3fc-0dc8cefac8fb","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:50986","PortSpecifier":{"PortValue":50986}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442196,"nanos":147363138},"http":{"id":"ce3b5984-2169-4f4a-b3fc-0dc8cefac8fb","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"ce3b5984-2169-4f4a-b3fc-0dc8cefac8fb","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"ce3b5984-2169-4f4a-b3fc-0dc8cefac8fb","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"ce3b5984-2169-4f4a-b3fc-0dc8cefac8fb","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"ce3b5984-2169-4f4a-b3fc-0dc8cefac8fb","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"ce3b5984-2169-4f4a-b3fc-0dc8cefac8fb"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"ce3b5984-2169-4f4a-b3fc-0dc8cefac8fb","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":147363138,"seconds":1783442196}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":50986},"address":"10.133.0.32:50986"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ce3b5984-2169-4f4a-b3fc-0dc8cefac8fb","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ce3b5984-2169-4f4a-b3fc-0dc8cefac8fb","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ce3b5984-2169-4f4a-b3fc-0dc8cefac8fb","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"ce3b5984-2169-4f4a-b3fc-0dc8cefac8fb","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ce3b5984-2169-4f4a-b3fc-0dc8cefac8fb","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:maas-admin:tester-admin-user"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ce3b5984-2169-4f4a-b3fc-0dc8cefac8fb","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ce3b5984-2169-4f4a-b3fc-0dc8cefac8fb","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:maas-admin\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ce3b5984-2169-4f4a-b3fc-0dc8cefac8fb","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ce3b5984-2169-4f4a-b3fc-0dc8cefac8fb","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"393c28f3-726b-4fcc-9fec-055101739622","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:50988","PortSpecifier":{"PortValue":50988}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"393c28f3-726b-4fcc-9fec-055101739622","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"393c28f3-726b-4fcc-9fec-055101739622","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:50988","PortSpecifier":{"PortValue":50988}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442196,"nanos":159976120},"http":{"id":"393c28f3-726b-4fcc-9fec-055101739622","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"393c28f3-726b-4fcc-9fec-055101739622","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"393c28f3-726b-4fcc-9fec-055101739622","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"393c28f3-726b-4fcc-9fec-055101739622","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"393c28f3-726b-4fcc-9fec-055101739622","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"393c28f3-726b-4fcc-9fec-055101739622"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"393c28f3-726b-4fcc-9fec-055101739622","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":159976120,"seconds":1783442196}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":50988},"address":"10.133.0.32:50988"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"393c28f3-726b-4fcc-9fec-055101739622","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"393c28f3-726b-4fcc-9fec-055101739622","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"393c28f3-726b-4fcc-9fec-055101739622","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"393c28f3-726b-4fcc-9fec-055101739622","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:maas-admin:tester-admin-user"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"393c28f3-726b-4fcc-9fec-055101739622","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:maas-admin\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"393c28f3-726b-4fcc-9fec-055101739622","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"393c28f3-726b-4fcc-9fec-055101739622","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"393c28f3-726b-4fcc-9fec-055101739622","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"393c28f3-726b-4fcc-9fec-055101739622","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"cb035a28-9720-45f7-9f01-655ed398a0d4","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:50992","PortSpecifier":{"PortValue":50992}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"cb035a28-9720-45f7-9f01-655ed398a0d4","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"cb035a28-9720-45f7-9f01-655ed398a0d4","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:50992","PortSpecifier":{"PortValue":50992}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442196,"nanos":192800571},"http":{"id":"cb035a28-9720-45f7-9f01-655ed398a0d4","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"cb035a28-9720-45f7-9f01-655ed398a0d4","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"cb035a28-9720-45f7-9f01-655ed398a0d4","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"cb035a28-9720-45f7-9f01-655ed398a0d4","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"cb035a28-9720-45f7-9f01-655ed398a0d4","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"cb035a28-9720-45f7-9f01-655ed398a0d4"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"cb035a28-9720-45f7-9f01-655ed398a0d4","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":192800571,"seconds":1783442196}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":50992},"address":"10.133.0.32:50992"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cb035a28-9720-45f7-9f01-655ed398a0d4","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cb035a28-9720-45f7-9f01-655ed398a0d4","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cb035a28-9720-45f7-9f01-655ed398a0d4","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"cb035a28-9720-45f7-9f01-655ed398a0d4","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cb035a28-9720-45f7-9f01-655ed398a0d4","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:maas-admin:tester-admin-user"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cb035a28-9720-45f7-9f01-655ed398a0d4","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:maas-admin\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cb035a28-9720-45f7-9f01-655ed398a0d4","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"cb035a28-9720-45f7-9f01-655ed398a0d4","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"cb035a28-9720-45f7-9f01-655ed398a0d4","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"06cc2cfe-edc1-4988-bf1d-3fb01047f15a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51004","PortSpecifier":{"PortValue":51004}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"06cc2cfe-edc1-4988-bf1d-3fb01047f15a","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"06cc2cfe-edc1-4988-bf1d-3fb01047f15a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51004","PortSpecifier":{"PortValue":51004}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442196,"nanos":205953902},"http":{"id":"06cc2cfe-edc1-4988-bf1d-3fb01047f15a","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"06cc2cfe-edc1-4988-bf1d-3fb01047f15a","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"06cc2cfe-edc1-4988-bf1d-3fb01047f15a","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"06cc2cfe-edc1-4988-bf1d-3fb01047f15a","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"06cc2cfe-edc1-4988-bf1d-3fb01047f15a","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"06cc2cfe-edc1-4988-bf1d-3fb01047f15a"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"06cc2cfe-edc1-4988-bf1d-3fb01047f15a","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":205953902,"seconds":1783442196}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":51004},"address":"10.133.0.32:51004"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"06cc2cfe-edc1-4988-bf1d-3fb01047f15a","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"06cc2cfe-edc1-4988-bf1d-3fb01047f15a","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"06cc2cfe-edc1-4988-bf1d-3fb01047f15a","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"06cc2cfe-edc1-4988-bf1d-3fb01047f15a","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"06cc2cfe-edc1-4988-bf1d-3fb01047f15a","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:maas-admin:tester-admin-user"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"06cc2cfe-edc1-4988-bf1d-3fb01047f15a","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:maas-admin\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"06cc2cfe-edc1-4988-bf1d-3fb01047f15a","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"06cc2cfe-edc1-4988-bf1d-3fb01047f15a","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"06cc2cfe-edc1-4988-bf1d-3fb01047f15a","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e719edf7-1d01-4b40-b82a-fa05c0b5e1e5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51012","PortSpecifier":{"PortValue":51012}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"e719edf7-1d01-4b40-b82a-fa05c0b5e1e5","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e719edf7-1d01-4b40-b82a-fa05c0b5e1e5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51012","PortSpecifier":{"PortValue":51012}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442196,"nanos":219054190},"http":{"id":"e719edf7-1d01-4b40-b82a-fa05c0b5e1e5","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"e719edf7-1d01-4b40-b82a-fa05c0b5e1e5","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"e719edf7-1d01-4b40-b82a-fa05c0b5e1e5","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"e719edf7-1d01-4b40-b82a-fa05c0b5e1e5","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"e719edf7-1d01-4b40-b82a-fa05c0b5e1e5","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"e719edf7-1d01-4b40-b82a-fa05c0b5e1e5"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"e719edf7-1d01-4b40-b82a-fa05c0b5e1e5","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":219054190,"seconds":1783442196}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":51012},"address":"10.133.0.32:51012"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e719edf7-1d01-4b40-b82a-fa05c0b5e1e5","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e719edf7-1d01-4b40-b82a-fa05c0b5e1e5","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e719edf7-1d01-4b40-b82a-fa05c0b5e1e5","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"e719edf7-1d01-4b40-b82a-fa05c0b5e1e5","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e719edf7-1d01-4b40-b82a-fa05c0b5e1e5","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:maas-admin\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e719edf7-1d01-4b40-b82a-fa05c0b5e1e5","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:maas-admin:tester-admin-user"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e719edf7-1d01-4b40-b82a-fa05c0b5e1e5","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e719edf7-1d01-4b40-b82a-fa05c0b5e1e5","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e719edf7-1d01-4b40-b82a-fa05c0b5e1e5","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f747ee77-15f3-4f2f-ac0f-337d77e9f7dd","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51028","PortSpecifier":{"PortValue":51028}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"f747ee77-15f3-4f2f-ac0f-337d77e9f7dd","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f747ee77-15f3-4f2f-ac0f-337d77e9f7dd","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51028","PortSpecifier":{"PortValue":51028}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442196,"nanos":230984491},"http":{"id":"f747ee77-15f3-4f2f-ac0f-337d77e9f7dd","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"f747ee77-15f3-4f2f-ac0f-337d77e9f7dd","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"f747ee77-15f3-4f2f-ac0f-337d77e9f7dd","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"f747ee77-15f3-4f2f-ac0f-337d77e9f7dd","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"f747ee77-15f3-4f2f-ac0f-337d77e9f7dd","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"f747ee77-15f3-4f2f-ac0f-337d77e9f7dd"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"f747ee77-15f3-4f2f-ac0f-337d77e9f7dd","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":230984491,"seconds":1783442196}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":51028},"address":"10.133.0.32:51028"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f747ee77-15f3-4f2f-ac0f-337d77e9f7dd","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f747ee77-15f3-4f2f-ac0f-337d77e9f7dd","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f747ee77-15f3-4f2f-ac0f-337d77e9f7dd","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"f747ee77-15f3-4f2f-ac0f-337d77e9f7dd","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f747ee77-15f3-4f2f-ac0f-337d77e9f7dd","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:maas-admin:tester-admin-user"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f747ee77-15f3-4f2f-ac0f-337d77e9f7dd","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f747ee77-15f3-4f2f-ac0f-337d77e9f7dd","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:maas-admin\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f747ee77-15f3-4f2f-ac0f-337d77e9f7dd","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f747ee77-15f3-4f2f-ac0f-337d77e9f7dd","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1c13a8a4-e02d-4476-b7a8-01d32ff6cd63","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51030","PortSpecifier":{"PortValue":51030}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"1c13a8a4-e02d-4476-b7a8-01d32ff6cd63","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1c13a8a4-e02d-4476-b7a8-01d32ff6cd63","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51030","PortSpecifier":{"PortValue":51030}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442196,"nanos":243642478},"http":{"id":"1c13a8a4-e02d-4476-b7a8-01d32ff6cd63","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"1c13a8a4-e02d-4476-b7a8-01d32ff6cd63","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"1c13a8a4-e02d-4476-b7a8-01d32ff6cd63","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"1c13a8a4-e02d-4476-b7a8-01d32ff6cd63","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"1c13a8a4-e02d-4476-b7a8-01d32ff6cd63","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"1c13a8a4-e02d-4476-b7a8-01d32ff6cd63"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"1c13a8a4-e02d-4476-b7a8-01d32ff6cd63","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":243642478,"seconds":1783442196}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":51030},"address":"10.133.0.32:51030"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1c13a8a4-e02d-4476-b7a8-01d32ff6cd63","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1c13a8a4-e02d-4476-b7a8-01d32ff6cd63","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1c13a8a4-e02d-4476-b7a8-01d32ff6cd63","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"1c13a8a4-e02d-4476-b7a8-01d32ff6cd63","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1c13a8a4-e02d-4476-b7a8-01d32ff6cd63","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:maas-admin:tester-admin-user"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1c13a8a4-e02d-4476-b7a8-01d32ff6cd63","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1c13a8a4-e02d-4476-b7a8-01d32ff6cd63","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:maas-admin\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1c13a8a4-e02d-4476-b7a8-01d32ff6cd63","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1c13a8a4-e02d-4476-b7a8-01d32ff6cd63","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0c8e9d60-668e-4ded-b147-90d5bd075db3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51040","PortSpecifier":{"PortValue":51040}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"0c8e9d60-668e-4ded-b147-90d5bd075db3","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0c8e9d60-668e-4ded-b147-90d5bd075db3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51040","PortSpecifier":{"PortValue":51040}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442196,"nanos":255270701},"http":{"id":"0c8e9d60-668e-4ded-b147-90d5bd075db3","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"0c8e9d60-668e-4ded-b147-90d5bd075db3","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"0c8e9d60-668e-4ded-b147-90d5bd075db3","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"0c8e9d60-668e-4ded-b147-90d5bd075db3","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"0c8e9d60-668e-4ded-b147-90d5bd075db3","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"0c8e9d60-668e-4ded-b147-90d5bd075db3"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"0c8e9d60-668e-4ded-b147-90d5bd075db3","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":255270701,"seconds":1783442196}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":51040},"address":"10.133.0.32:51040"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0c8e9d60-668e-4ded-b147-90d5bd075db3","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0c8e9d60-668e-4ded-b147-90d5bd075db3","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0c8e9d60-668e-4ded-b147-90d5bd075db3","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"0c8e9d60-668e-4ded-b147-90d5bd075db3","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0c8e9d60-668e-4ded-b147-90d5bd075db3","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0c8e9d60-668e-4ded-b147-90d5bd075db3","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:maas-admin:tester-admin-user"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0c8e9d60-668e-4ded-b147-90d5bd075db3","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:maas-admin\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0c8e9d60-668e-4ded-b147-90d5bd075db3","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0c8e9d60-668e-4ded-b147-90d5bd075db3","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b813040b-6695-4036-9ccc-78aa2c37015e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51050","PortSpecifier":{"PortValue":51050}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"b813040b-6695-4036-9ccc-78aa2c37015e","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b813040b-6695-4036-9ccc-78aa2c37015e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51050","PortSpecifier":{"PortValue":51050}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442196,"nanos":267566757},"http":{"id":"b813040b-6695-4036-9ccc-78aa2c37015e","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"b813040b-6695-4036-9ccc-78aa2c37015e","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"b813040b-6695-4036-9ccc-78aa2c37015e","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"b813040b-6695-4036-9ccc-78aa2c37015e","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"b813040b-6695-4036-9ccc-78aa2c37015e","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"b813040b-6695-4036-9ccc-78aa2c37015e"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"b813040b-6695-4036-9ccc-78aa2c37015e","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":267566757,"seconds":1783442196}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":51050},"address":"10.133.0.32:51050"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b813040b-6695-4036-9ccc-78aa2c37015e","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b813040b-6695-4036-9ccc-78aa2c37015e","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b813040b-6695-4036-9ccc-78aa2c37015e","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b813040b-6695-4036-9ccc-78aa2c37015e","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:maas-admin:tester-admin-user"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"b813040b-6695-4036-9ccc-78aa2c37015e","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b813040b-6695-4036-9ccc-78aa2c37015e","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:maas-admin\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b813040b-6695-4036-9ccc-78aa2c37015e","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b813040b-6695-4036-9ccc-78aa2c37015e","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b813040b-6695-4036-9ccc-78aa2c37015e","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6354deb0-bbf6-48d6-970f-465d6f0a186a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51054","PortSpecifier":{"PortValue":51054}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"6354deb0-bbf6-48d6-970f-465d6f0a186a","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6354deb0-bbf6-48d6-970f-465d6f0a186a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51054","PortSpecifier":{"PortValue":51054}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442196,"nanos":292384801},"http":{"id":"6354deb0-bbf6-48d6-970f-465d6f0a186a","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"6354deb0-bbf6-48d6-970f-465d6f0a186a","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"6354deb0-bbf6-48d6-970f-465d6f0a186a","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"6354deb0-bbf6-48d6-970f-465d6f0a186a","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"6354deb0-bbf6-48d6-970f-465d6f0a186a","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"6354deb0-bbf6-48d6-970f-465d6f0a186a"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"6354deb0-bbf6-48d6-970f-465d6f0a186a","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":292384801,"seconds":1783442196}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":51054},"address":"10.133.0.32:51054"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6354deb0-bbf6-48d6-970f-465d6f0a186a","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6354deb0-bbf6-48d6-970f-465d6f0a186a","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6354deb0-bbf6-48d6-970f-465d6f0a186a","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"6354deb0-bbf6-48d6-970f-465d6f0a186a","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6354deb0-bbf6-48d6-970f-465d6f0a186a","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:maas-admin:tester-admin-user"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6354deb0-bbf6-48d6-970f-465d6f0a186a","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6354deb0-bbf6-48d6-970f-465d6f0a186a","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:maas-admin\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6354deb0-bbf6-48d6-970f-465d6f0a186a","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6354deb0-bbf6-48d6-970f-465d6f0a186a","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9cd160ef-3340-4647-8e1e-58d710e6bea1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51070","PortSpecifier":{"PortValue":51070}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"9cd160ef-3340-4647-8e1e-58d710e6bea1","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9cd160ef-3340-4647-8e1e-58d710e6bea1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51070","PortSpecifier":{"PortValue":51070}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442196,"nanos":305696720},"http":{"id":"9cd160ef-3340-4647-8e1e-58d710e6bea1","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"9cd160ef-3340-4647-8e1e-58d710e6bea1","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"9cd160ef-3340-4647-8e1e-58d710e6bea1","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"9cd160ef-3340-4647-8e1e-58d710e6bea1","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"9cd160ef-3340-4647-8e1e-58d710e6bea1","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"9cd160ef-3340-4647-8e1e-58d710e6bea1"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"9cd160ef-3340-4647-8e1e-58d710e6bea1","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":305696720,"seconds":1783442196}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":51070},"address":"10.133.0.32:51070"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9cd160ef-3340-4647-8e1e-58d710e6bea1","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9cd160ef-3340-4647-8e1e-58d710e6bea1","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9cd160ef-3340-4647-8e1e-58d710e6bea1","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"9cd160ef-3340-4647-8e1e-58d710e6bea1","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9cd160ef-3340-4647-8e1e-58d710e6bea1","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9cd160ef-3340-4647-8e1e-58d710e6bea1","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:maas-admin\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9cd160ef-3340-4647-8e1e-58d710e6bea1","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:maas-admin:tester-admin-user"}
{"level":"info","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9cd160ef-3340-4647-8e1e-58d710e6bea1","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9cd160ef-3340-4647-8e1e-58d710e6bea1","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b72bafbb-812c-4939-a66d-2e735df90d19","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51086","PortSpecifier":{"PortValue":51086}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"b72bafbb-812c-4939-a66d-2e735df90d19","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b72bafbb-812c-4939-a66d-2e735df90d19","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51086","PortSpecifier":{"PortValue":51086}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442196,"nanos":317818970},"http":{"id":"b72bafbb-812c-4939-a66d-2e735df90d19","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"b72bafbb-812c-4939-a66d-2e735df90d19","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"b72bafbb-812c-4939-a66d-2e735df90d19","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"b72bafbb-812c-4939-a66d-2e735df90d19","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"b72bafbb-812c-4939-a66d-2e735df90d19","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"b72bafbb-812c-4939-a66d-2e735df90d19"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"b72bafbb-812c-4939-a66d-2e735df90d19","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":317818970,"seconds":1783442196}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":51086},"address":"10.133.0.32:51086"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b72bafbb-812c-4939-a66d-2e735df90d19","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b72bafbb-812c-4939-a66d-2e735df90d19","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b72bafbb-812c-4939-a66d-2e735df90d19","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"b72bafbb-812c-4939-a66d-2e735df90d19","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b72bafbb-812c-4939-a66d-2e735df90d19","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:maas-admin:tester-admin-user"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b72bafbb-812c-4939-a66d-2e735df90d19","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b72bafbb-812c-4939-a66d-2e735df90d19","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:maas-admin\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b72bafbb-812c-4939-a66d-2e735df90d19","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b72bafbb-812c-4939-a66d-2e735df90d19","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1bf2c479-cc2f-42b6-8588-5ea8d51684a4","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51090","PortSpecifier":{"PortValue":51090}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"1bf2c479-cc2f-42b6-8588-5ea8d51684a4","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1bf2c479-cc2f-42b6-8588-5ea8d51684a4","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51090","PortSpecifier":{"PortValue":51090}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442196,"nanos":330219137},"http":{"id":"1bf2c479-cc2f-42b6-8588-5ea8d51684a4","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"1bf2c479-cc2f-42b6-8588-5ea8d51684a4","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"1bf2c479-cc2f-42b6-8588-5ea8d51684a4","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"1bf2c479-cc2f-42b6-8588-5ea8d51684a4","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"1bf2c479-cc2f-42b6-8588-5ea8d51684a4","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"1bf2c479-cc2f-42b6-8588-5ea8d51684a4"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"1bf2c479-cc2f-42b6-8588-5ea8d51684a4","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":330219137,"seconds":1783442196}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":51090},"address":"10.133.0.32:51090"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1bf2c479-cc2f-42b6-8588-5ea8d51684a4","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1bf2c479-cc2f-42b6-8588-5ea8d51684a4","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1bf2c479-cc2f-42b6-8588-5ea8d51684a4","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1bf2c479-cc2f-42b6-8588-5ea8d51684a4","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:maas-admin:tester-admin-user"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1bf2c479-cc2f-42b6-8588-5ea8d51684a4","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"1bf2c479-cc2f-42b6-8588-5ea8d51684a4","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1bf2c479-cc2f-42b6-8588-5ea8d51684a4","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:maas-admin\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1bf2c479-cc2f-42b6-8588-5ea8d51684a4","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1bf2c479-cc2f-42b6-8588-5ea8d51684a4","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ee59fa0f-ece5-4efe-8c0d-d01b21900fcf","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51104","PortSpecifier":{"PortValue":51104}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"ee59fa0f-ece5-4efe-8c0d-d01b21900fcf","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ee59fa0f-ece5-4efe-8c0d-d01b21900fcf","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51104","PortSpecifier":{"PortValue":51104}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442196,"nanos":342405907},"http":{"id":"ee59fa0f-ece5-4efe-8c0d-d01b21900fcf","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"ee59fa0f-ece5-4efe-8c0d-d01b21900fcf","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"ee59fa0f-ece5-4efe-8c0d-d01b21900fcf","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"ee59fa0f-ece5-4efe-8c0d-d01b21900fcf","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"ee59fa0f-ece5-4efe-8c0d-d01b21900fcf","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"ee59fa0f-ece5-4efe-8c0d-d01b21900fcf"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"ee59fa0f-ece5-4efe-8c0d-d01b21900fcf","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":342405907,"seconds":1783442196}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":51104},"address":"10.133.0.32:51104"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ee59fa0f-ece5-4efe-8c0d-d01b21900fcf","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ee59fa0f-ece5-4efe-8c0d-d01b21900fcf","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ee59fa0f-ece5-4efe-8c0d-d01b21900fcf","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"ee59fa0f-ece5-4efe-8c0d-d01b21900fcf","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ee59fa0f-ece5-4efe-8c0d-d01b21900fcf","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ee59fa0f-ece5-4efe-8c0d-d01b21900fcf","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:maas-admin:tester-admin-user"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ee59fa0f-ece5-4efe-8c0d-d01b21900fcf","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:maas-admin\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ee59fa0f-ece5-4efe-8c0d-d01b21900fcf","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ee59fa0f-ece5-4efe-8c0d-d01b21900fcf","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c489dcbf-df6f-4d41-a3fa-a78d18cc89bd","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51106","PortSpecifier":{"PortValue":51106}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"c489dcbf-df6f-4d41-a3fa-a78d18cc89bd","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c489dcbf-df6f-4d41-a3fa-a78d18cc89bd","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51106","PortSpecifier":{"PortValue":51106}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442196,"nanos":390189574},"http":{"id":"c489dcbf-df6f-4d41-a3fa-a78d18cc89bd","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"c489dcbf-df6f-4d41-a3fa-a78d18cc89bd","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"c489dcbf-df6f-4d41-a3fa-a78d18cc89bd","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"c489dcbf-df6f-4d41-a3fa-a78d18cc89bd","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"c489dcbf-df6f-4d41-a3fa-a78d18cc89bd","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"c489dcbf-df6f-4d41-a3fa-a78d18cc89bd"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"c489dcbf-df6f-4d41-a3fa-a78d18cc89bd","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":390189574,"seconds":1783442196}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":51106},"address":"10.133.0.32:51106"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c489dcbf-df6f-4d41-a3fa-a78d18cc89bd","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c489dcbf-df6f-4d41-a3fa-a78d18cc89bd","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c489dcbf-df6f-4d41-a3fa-a78d18cc89bd","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"c489dcbf-df6f-4d41-a3fa-a78d18cc89bd","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c489dcbf-df6f-4d41-a3fa-a78d18cc89bd","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:maas-admin:tester-admin-user"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c489dcbf-df6f-4d41-a3fa-a78d18cc89bd","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:maas-admin\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c489dcbf-df6f-4d41-a3fa-a78d18cc89bd","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c489dcbf-df6f-4d41-a3fa-a78d18cc89bd","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c489dcbf-df6f-4d41-a3fa-a78d18cc89bd","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"353c4f27-a3da-41fd-b6cf-c1de1c878169","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51118","PortSpecifier":{"PortValue":51118}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"353c4f27-a3da-41fd-b6cf-c1de1c878169","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"353c4f27-a3da-41fd-b6cf-c1de1c878169","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51118","PortSpecifier":{"PortValue":51118}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442196,"nanos":402697830},"http":{"id":"353c4f27-a3da-41fd-b6cf-c1de1c878169","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"353c4f27-a3da-41fd-b6cf-c1de1c878169","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"353c4f27-a3da-41fd-b6cf-c1de1c878169","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"353c4f27-a3da-41fd-b6cf-c1de1c878169","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"353c4f27-a3da-41fd-b6cf-c1de1c878169","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"353c4f27-a3da-41fd-b6cf-c1de1c878169"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"353c4f27-a3da-41fd-b6cf-c1de1c878169","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":402697830,"seconds":1783442196}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":51118},"address":"10.133.0.32:51118"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"353c4f27-a3da-41fd-b6cf-c1de1c878169","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"353c4f27-a3da-41fd-b6cf-c1de1c878169","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"353c4f27-a3da-41fd-b6cf-c1de1c878169","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"353c4f27-a3da-41fd-b6cf-c1de1c878169","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"353c4f27-a3da-41fd-b6cf-c1de1c878169","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"353c4f27-a3da-41fd-b6cf-c1de1c878169","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:maas-admin:tester-admin-user"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"353c4f27-a3da-41fd-b6cf-c1de1c878169","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:maas-admin\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"353c4f27-a3da-41fd-b6cf-c1de1c878169","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"353c4f27-a3da-41fd-b6cf-c1de1c878169","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"618844ca-5b3f-4e4e-b589-ddc7dceba14f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51120","PortSpecifier":{"PortValue":51120}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"618844ca-5b3f-4e4e-b589-ddc7dceba14f","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"618844ca-5b3f-4e4e-b589-ddc7dceba14f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51120","PortSpecifier":{"PortValue":51120}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442196,"nanos":415179505},"http":{"id":"618844ca-5b3f-4e4e-b589-ddc7dceba14f","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"618844ca-5b3f-4e4e-b589-ddc7dceba14f","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"618844ca-5b3f-4e4e-b589-ddc7dceba14f","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"618844ca-5b3f-4e4e-b589-ddc7dceba14f","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"618844ca-5b3f-4e4e-b589-ddc7dceba14f","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"618844ca-5b3f-4e4e-b589-ddc7dceba14f"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"618844ca-5b3f-4e4e-b589-ddc7dceba14f","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":415179505,"seconds":1783442196}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":51120},"address":"10.133.0.32:51120"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"618844ca-5b3f-4e4e-b589-ddc7dceba14f","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"618844ca-5b3f-4e4e-b589-ddc7dceba14f","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"618844ca-5b3f-4e4e-b589-ddc7dceba14f","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"618844ca-5b3f-4e4e-b589-ddc7dceba14f","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"618844ca-5b3f-4e4e-b589-ddc7dceba14f","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:maas-admin:tester-admin-user"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"618844ca-5b3f-4e4e-b589-ddc7dceba14f","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:maas-admin\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"618844ca-5b3f-4e4e-b589-ddc7dceba14f","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"618844ca-5b3f-4e4e-b589-ddc7dceba14f","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"618844ca-5b3f-4e4e-b589-ddc7dceba14f","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9c68995f-400b-496f-b7fd-895dd3a0e596","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51134","PortSpecifier":{"PortValue":51134}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"9c68995f-400b-496f-b7fd-895dd3a0e596","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9c68995f-400b-496f-b7fd-895dd3a0e596","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51134","PortSpecifier":{"PortValue":51134}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442196,"nanos":428008504},"http":{"id":"9c68995f-400b-496f-b7fd-895dd3a0e596","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"9c68995f-400b-496f-b7fd-895dd3a0e596","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"9c68995f-400b-496f-b7fd-895dd3a0e596","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"9c68995f-400b-496f-b7fd-895dd3a0e596","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"9c68995f-400b-496f-b7fd-895dd3a0e596","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"9c68995f-400b-496f-b7fd-895dd3a0e596"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"9c68995f-400b-496f-b7fd-895dd3a0e596","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":428008504,"seconds":1783442196}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":51134},"address":"10.133.0.32:51134"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9c68995f-400b-496f-b7fd-895dd3a0e596","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9c68995f-400b-496f-b7fd-895dd3a0e596","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9c68995f-400b-496f-b7fd-895dd3a0e596","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"9c68995f-400b-496f-b7fd-895dd3a0e596","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9c68995f-400b-496f-b7fd-895dd3a0e596","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:maas-admin\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9c68995f-400b-496f-b7fd-895dd3a0e596","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:maas-admin:tester-admin-user"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9c68995f-400b-496f-b7fd-895dd3a0e596","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9c68995f-400b-496f-b7fd-895dd3a0e596","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9c68995f-400b-496f-b7fd-895dd3a0e596","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"31be453d-168c-499f-a46b-28389857e1ad","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51144","PortSpecifier":{"PortValue":51144}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"31be453d-168c-499f-a46b-28389857e1ad","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"31be453d-168c-499f-a46b-28389857e1ad","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51144","PortSpecifier":{"PortValue":51144}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442196,"nanos":440316000},"http":{"id":"31be453d-168c-499f-a46b-28389857e1ad","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"31be453d-168c-499f-a46b-28389857e1ad","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"31be453d-168c-499f-a46b-28389857e1ad","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"31be453d-168c-499f-a46b-28389857e1ad","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"31be453d-168c-499f-a46b-28389857e1ad","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"31be453d-168c-499f-a46b-28389857e1ad"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"31be453d-168c-499f-a46b-28389857e1ad","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":440316000,"seconds":1783442196}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":51144},"address":"10.133.0.32:51144"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"31be453d-168c-499f-a46b-28389857e1ad","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"31be453d-168c-499f-a46b-28389857e1ad","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"31be453d-168c-499f-a46b-28389857e1ad","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"31be453d-168c-499f-a46b-28389857e1ad","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:maas-admin:tester-admin-user"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"31be453d-168c-499f-a46b-28389857e1ad","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"31be453d-168c-499f-a46b-28389857e1ad","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"31be453d-168c-499f-a46b-28389857e1ad","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:maas-admin\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"31be453d-168c-499f-a46b-28389857e1ad","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"31be453d-168c-499f-a46b-28389857e1ad","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"cab9ed92-cd94-4f97-946f-51c27e83bb3c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51148","PortSpecifier":{"PortValue":51148}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"cab9ed92-cd94-4f97-946f-51c27e83bb3c","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"cab9ed92-cd94-4f97-946f-51c27e83bb3c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51148","PortSpecifier":{"PortValue":51148}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442196,"nanos":452545793},"http":{"id":"cab9ed92-cd94-4f97-946f-51c27e83bb3c","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"cab9ed92-cd94-4f97-946f-51c27e83bb3c","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"cab9ed92-cd94-4f97-946f-51c27e83bb3c","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"cab9ed92-cd94-4f97-946f-51c27e83bb3c","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"cab9ed92-cd94-4f97-946f-51c27e83bb3c","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"cab9ed92-cd94-4f97-946f-51c27e83bb3c"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"cab9ed92-cd94-4f97-946f-51c27e83bb3c","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":452545793,"seconds":1783442196}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":51148},"address":"10.133.0.32:51148"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cab9ed92-cd94-4f97-946f-51c27e83bb3c","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cab9ed92-cd94-4f97-946f-51c27e83bb3c","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cab9ed92-cd94-4f97-946f-51c27e83bb3c","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cab9ed92-cd94-4f97-946f-51c27e83bb3c","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:maas-admin:tester-admin-user"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"cab9ed92-cd94-4f97-946f-51c27e83bb3c","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cab9ed92-cd94-4f97-946f-51c27e83bb3c","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cab9ed92-cd94-4f97-946f-51c27e83bb3c","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:maas-admin\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"cab9ed92-cd94-4f97-946f-51c27e83bb3c","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"cab9ed92-cd94-4f97-946f-51c27e83bb3c","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7701f652-0184-45af-b613-75d587c37d5a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51154","PortSpecifier":{"PortValue":51154}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"7701f652-0184-45af-b613-75d587c37d5a","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7701f652-0184-45af-b613-75d587c37d5a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51154","PortSpecifier":{"PortValue":51154}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442196,"nanos":465070306},"http":{"id":"7701f652-0184-45af-b613-75d587c37d5a","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"7701f652-0184-45af-b613-75d587c37d5a","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"7701f652-0184-45af-b613-75d587c37d5a","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"7701f652-0184-45af-b613-75d587c37d5a","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"7701f652-0184-45af-b613-75d587c37d5a","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"7701f652-0184-45af-b613-75d587c37d5a"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"7701f652-0184-45af-b613-75d587c37d5a","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":465070306,"seconds":1783442196}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":51154},"address":"10.133.0.32:51154"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7701f652-0184-45af-b613-75d587c37d5a","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7701f652-0184-45af-b613-75d587c37d5a","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7701f652-0184-45af-b613-75d587c37d5a","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7701f652-0184-45af-b613-75d587c37d5a","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"7701f652-0184-45af-b613-75d587c37d5a","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7701f652-0184-45af-b613-75d587c37d5a","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:maas-admin\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7701f652-0184-45af-b613-75d587c37d5a","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:maas-admin:tester-admin-user"}
{"level":"info","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7701f652-0184-45af-b613-75d587c37d5a","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7701f652-0184-45af-b613-75d587c37d5a","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0056da37-b404-499c-9025-6425b50288fc","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51158","PortSpecifier":{"PortValue":51158}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"0056da37-b404-499c-9025-6425b50288fc","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0056da37-b404-499c-9025-6425b50288fc","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51158","PortSpecifier":{"PortValue":51158}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442196,"nanos":498577288},"http":{"id":"0056da37-b404-499c-9025-6425b50288fc","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"0056da37-b404-499c-9025-6425b50288fc","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"0056da37-b404-499c-9025-6425b50288fc","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"0056da37-b404-499c-9025-6425b50288fc","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"0056da37-b404-499c-9025-6425b50288fc","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"0056da37-b404-499c-9025-6425b50288fc"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"0056da37-b404-499c-9025-6425b50288fc","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":498577288,"seconds":1783442196}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":51158},"address":"10.133.0.32:51158"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0056da37-b404-499c-9025-6425b50288fc","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0056da37-b404-499c-9025-6425b50288fc","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0056da37-b404-499c-9025-6425b50288fc","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"0056da37-b404-499c-9025-6425b50288fc","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0056da37-b404-499c-9025-6425b50288fc","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:maas-admin\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0056da37-b404-499c-9025-6425b50288fc","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:maas-admin:tester-admin-user"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0056da37-b404-499c-9025-6425b50288fc","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0056da37-b404-499c-9025-6425b50288fc","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0056da37-b404-499c-9025-6425b50288fc","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8d8b0c90-36a9-4508-a3c3-85740464ee85","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51166","PortSpecifier":{"PortValue":51166}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"8d8b0c90-36a9-4508-a3c3-85740464ee85","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8d8b0c90-36a9-4508-a3c3-85740464ee85","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51166","PortSpecifier":{"PortValue":51166}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442196,"nanos":510898079},"http":{"id":"8d8b0c90-36a9-4508-a3c3-85740464ee85","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"8d8b0c90-36a9-4508-a3c3-85740464ee85","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"8d8b0c90-36a9-4508-a3c3-85740464ee85","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"8d8b0c90-36a9-4508-a3c3-85740464ee85","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"8d8b0c90-36a9-4508-a3c3-85740464ee85","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"8d8b0c90-36a9-4508-a3c3-85740464ee85"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"8d8b0c90-36a9-4508-a3c3-85740464ee85","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":510898079,"seconds":1783442196}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":51166},"address":"10.133.0.32:51166"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8d8b0c90-36a9-4508-a3c3-85740464ee85","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8d8b0c90-36a9-4508-a3c3-85740464ee85","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8d8b0c90-36a9-4508-a3c3-85740464ee85","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"8d8b0c90-36a9-4508-a3c3-85740464ee85","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8d8b0c90-36a9-4508-a3c3-85740464ee85","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:maas-admin:tester-admin-user"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8d8b0c90-36a9-4508-a3c3-85740464ee85","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8d8b0c90-36a9-4508-a3c3-85740464ee85","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:maas-admin\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8d8b0c90-36a9-4508-a3c3-85740464ee85","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8d8b0c90-36a9-4508-a3c3-85740464ee85","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2c8bfbbb-c106-43ef-8b02-aa3f6e9b4846","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51168","PortSpecifier":{"PortValue":51168}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"2c8bfbbb-c106-43ef-8b02-aa3f6e9b4846","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2c8bfbbb-c106-43ef-8b02-aa3f6e9b4846","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51168","PortSpecifier":{"PortValue":51168}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442196,"nanos":523345807},"http":{"id":"2c8bfbbb-c106-43ef-8b02-aa3f6e9b4846","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"2c8bfbbb-c106-43ef-8b02-aa3f6e9b4846","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"2c8bfbbb-c106-43ef-8b02-aa3f6e9b4846","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"2c8bfbbb-c106-43ef-8b02-aa3f6e9b4846","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"2c8bfbbb-c106-43ef-8b02-aa3f6e9b4846","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"2c8bfbbb-c106-43ef-8b02-aa3f6e9b4846"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"2c8bfbbb-c106-43ef-8b02-aa3f6e9b4846","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":523345807,"seconds":1783442196}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":51168},"address":"10.133.0.32:51168"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2c8bfbbb-c106-43ef-8b02-aa3f6e9b4846","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"2c8bfbbb-c106-43ef-8b02-aa3f6e9b4846","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2c8bfbbb-c106-43ef-8b02-aa3f6e9b4846","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:maas-admin:tester-admin-user"}
{"level":"info","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2c8bfbbb-c106-43ef-8b02-aa3f6e9b4846","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2c8bfbbb-c106-43ef-8b02-aa3f6e9b4846","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e3665a82-fc4e-4199-8066-878e8469415b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51176","PortSpecifier":{"PortValue":51176}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"e3665a82-fc4e-4199-8066-878e8469415b","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e3665a82-fc4e-4199-8066-878e8469415b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51176","PortSpecifier":{"PortValue":51176}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442196,"nanos":535893331},"http":{"id":"e3665a82-fc4e-4199-8066-878e8469415b","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"e3665a82-fc4e-4199-8066-878e8469415b","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"e3665a82-fc4e-4199-8066-878e8469415b","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"e3665a82-fc4e-4199-8066-878e8469415b","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"e3665a82-fc4e-4199-8066-878e8469415b","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"e3665a82-fc4e-4199-8066-878e8469415b"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"e3665a82-fc4e-4199-8066-878e8469415b","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":535893331,"seconds":1783442196}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":51176},"address":"10.133.0.32:51176"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"e3665a82-fc4e-4199-8066-878e8469415b","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e3665a82-fc4e-4199-8066-878e8469415b","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e3665a82-fc4e-4199-8066-878e8469415b","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"20396483-8644-436a-bfb2-c32efee9feae","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51190","PortSpecifier":{"PortValue":51190}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"20396483-8644-436a-bfb2-c32efee9feae","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"20396483-8644-436a-bfb2-c32efee9feae","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51190","PortSpecifier":{"PortValue":51190}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442196,"nanos":548710708},"http":{"id":"20396483-8644-436a-bfb2-c32efee9feae","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"20396483-8644-436a-bfb2-c32efee9feae","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"20396483-8644-436a-bfb2-c32efee9feae","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"20396483-8644-436a-bfb2-c32efee9feae","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"20396483-8644-436a-bfb2-c32efee9feae","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"20396483-8644-436a-bfb2-c32efee9feae"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"20396483-8644-436a-bfb2-c32efee9feae","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":548710708,"seconds":1783442196}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":51190},"address":"10.133.0.32:51190"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"20396483-8644-436a-bfb2-c32efee9feae","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"20396483-8644-436a-bfb2-c32efee9feae","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"20396483-8644-436a-bfb2-c32efee9feae","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"11f45cbb-a051-49da-a453-66c93eb75a19","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51204","PortSpecifier":{"PortValue":51204}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"11f45cbb-a051-49da-a453-66c93eb75a19","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"11f45cbb-a051-49da-a453-66c93eb75a19","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51204","PortSpecifier":{"PortValue":51204}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442196,"nanos":561171705},"http":{"id":"11f45cbb-a051-49da-a453-66c93eb75a19","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"11f45cbb-a051-49da-a453-66c93eb75a19","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"11f45cbb-a051-49da-a453-66c93eb75a19","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"11f45cbb-a051-49da-a453-66c93eb75a19","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"11f45cbb-a051-49da-a453-66c93eb75a19","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"11f45cbb-a051-49da-a453-66c93eb75a19"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"11f45cbb-a051-49da-a453-66c93eb75a19","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":561171705,"seconds":1783442196}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":51204},"address":"10.133.0.32:51204"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"11f45cbb-a051-49da-a453-66c93eb75a19","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"11f45cbb-a051-49da-a453-66c93eb75a19","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"11f45cbb-a051-49da-a453-66c93eb75a19","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"76c039aa-a404-446c-8775-cfc5288beb7f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51216","PortSpecifier":{"PortValue":51216}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"76c039aa-a404-446c-8775-cfc5288beb7f","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"76c039aa-a404-446c-8775-cfc5288beb7f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51216","PortSpecifier":{"PortValue":51216}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442196,"nanos":598453657},"http":{"id":"76c039aa-a404-446c-8775-cfc5288beb7f","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"76c039aa-a404-446c-8775-cfc5288beb7f","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"76c039aa-a404-446c-8775-cfc5288beb7f","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"76c039aa-a404-446c-8775-cfc5288beb7f","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"76c039aa-a404-446c-8775-cfc5288beb7f","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"76c039aa-a404-446c-8775-cfc5288beb7f"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"76c039aa-a404-446c-8775-cfc5288beb7f","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":598453657,"seconds":1783442196}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":51216},"address":"10.133.0.32:51216"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"76c039aa-a404-446c-8775-cfc5288beb7f","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"76c039aa-a404-446c-8775-cfc5288beb7f","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"76c039aa-a404-446c-8775-cfc5288beb7f","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"665da575-8e80-45d2-b202-4ba17b354d19","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51220","PortSpecifier":{"PortValue":51220}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"665da575-8e80-45d2-b202-4ba17b354d19","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"665da575-8e80-45d2-b202-4ba17b354d19","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51220","PortSpecifier":{"PortValue":51220}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442196,"nanos":612120049},"http":{"id":"665da575-8e80-45d2-b202-4ba17b354d19","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"665da575-8e80-45d2-b202-4ba17b354d19","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"665da575-8e80-45d2-b202-4ba17b354d19","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"665da575-8e80-45d2-b202-4ba17b354d19","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"665da575-8e80-45d2-b202-4ba17b354d19","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"665da575-8e80-45d2-b202-4ba17b354d19"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"665da575-8e80-45d2-b202-4ba17b354d19","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":612120049,"seconds":1783442196}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":51220},"address":"10.133.0.32:51220"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"665da575-8e80-45d2-b202-4ba17b354d19","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"665da575-8e80-45d2-b202-4ba17b354d19","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"665da575-8e80-45d2-b202-4ba17b354d19","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c6f28f5d-99f2-4789-b2f0-5e02a524c180","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51222","PortSpecifier":{"PortValue":51222}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"c6f28f5d-99f2-4789-b2f0-5e02a524c180","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c6f28f5d-99f2-4789-b2f0-5e02a524c180","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51222","PortSpecifier":{"PortValue":51222}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442196,"nanos":624464866},"http":{"id":"c6f28f5d-99f2-4789-b2f0-5e02a524c180","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"c6f28f5d-99f2-4789-b2f0-5e02a524c180","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"c6f28f5d-99f2-4789-b2f0-5e02a524c180","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"c6f28f5d-99f2-4789-b2f0-5e02a524c180","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"c6f28f5d-99f2-4789-b2f0-5e02a524c180","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"c6f28f5d-99f2-4789-b2f0-5e02a524c180"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"c6f28f5d-99f2-4789-b2f0-5e02a524c180","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":624464866,"seconds":1783442196}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":51222},"address":"10.133.0.32:51222"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"c6f28f5d-99f2-4789-b2f0-5e02a524c180","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c6f28f5d-99f2-4789-b2f0-5e02a524c180","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c6f28f5d-99f2-4789-b2f0-5e02a524c180","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"81f6ba2b-c028-44fc-838b-31daa68f10ee","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51226","PortSpecifier":{"PortValue":51226}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"81f6ba2b-c028-44fc-838b-31daa68f10ee","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"81f6ba2b-c028-44fc-838b-31daa68f10ee","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51226","PortSpecifier":{"PortValue":51226}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442196,"nanos":637460291},"http":{"id":"81f6ba2b-c028-44fc-838b-31daa68f10ee","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"81f6ba2b-c028-44fc-838b-31daa68f10ee","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"81f6ba2b-c028-44fc-838b-31daa68f10ee","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"81f6ba2b-c028-44fc-838b-31daa68f10ee","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"81f6ba2b-c028-44fc-838b-31daa68f10ee","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"81f6ba2b-c028-44fc-838b-31daa68f10ee"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"81f6ba2b-c028-44fc-838b-31daa68f10ee","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":637460291,"seconds":1783442196}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":51226},"address":"10.133.0.32:51226"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"81f6ba2b-c028-44fc-838b-31daa68f10ee","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"81f6ba2b-c028-44fc-838b-31daa68f10ee","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"81f6ba2b-c028-44fc-838b-31daa68f10ee","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"61f7f931-2fe6-40c2-bf1c-5689cfdeecb2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51240","PortSpecifier":{"PortValue":51240}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"61f7f931-2fe6-40c2-bf1c-5689cfdeecb2","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"61f7f931-2fe6-40c2-bf1c-5689cfdeecb2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51240","PortSpecifier":{"PortValue":51240}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442196,"nanos":649674247},"http":{"id":"61f7f931-2fe6-40c2-bf1c-5689cfdeecb2","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"61f7f931-2fe6-40c2-bf1c-5689cfdeecb2","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"61f7f931-2fe6-40c2-bf1c-5689cfdeecb2","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"61f7f931-2fe6-40c2-bf1c-5689cfdeecb2","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"61f7f931-2fe6-40c2-bf1c-5689cfdeecb2","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"61f7f931-2fe6-40c2-bf1c-5689cfdeecb2"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"61f7f931-2fe6-40c2-bf1c-5689cfdeecb2","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":649674247,"seconds":1783442196}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":51240},"address":"10.133.0.32:51240"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"61f7f931-2fe6-40c2-bf1c-5689cfdeecb2","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"61f7f931-2fe6-40c2-bf1c-5689cfdeecb2","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"61f7f931-2fe6-40c2-bf1c-5689cfdeecb2","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0c29730e-359c-4a82-93e7-9a172e6142e7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51242","PortSpecifier":{"PortValue":51242}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"0c29730e-359c-4a82-93e7-9a172e6142e7","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0c29730e-359c-4a82-93e7-9a172e6142e7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51242","PortSpecifier":{"PortValue":51242}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442196,"nanos":661702936},"http":{"id":"0c29730e-359c-4a82-93e7-9a172e6142e7","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"0c29730e-359c-4a82-93e7-9a172e6142e7","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"0c29730e-359c-4a82-93e7-9a172e6142e7","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"0c29730e-359c-4a82-93e7-9a172e6142e7","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"0c29730e-359c-4a82-93e7-9a172e6142e7","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"0c29730e-359c-4a82-93e7-9a172e6142e7"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"0c29730e-359c-4a82-93e7-9a172e6142e7","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":661702936,"seconds":1783442196}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":51242},"address":"10.133.0.32:51242"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"0c29730e-359c-4a82-93e7-9a172e6142e7","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0c29730e-359c-4a82-93e7-9a172e6142e7","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0c29730e-359c-4a82-93e7-9a172e6142e7","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9ab01578-13a0-4a4d-aa6d-56c1bc559dd8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51248","PortSpecifier":{"PortValue":51248}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"9ab01578-13a0-4a4d-aa6d-56c1bc559dd8","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9ab01578-13a0-4a4d-aa6d-56c1bc559dd8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51248","PortSpecifier":{"PortValue":51248}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442196,"nanos":692097648},"http":{"id":"9ab01578-13a0-4a4d-aa6d-56c1bc559dd8","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"9ab01578-13a0-4a4d-aa6d-56c1bc559dd8","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"9ab01578-13a0-4a4d-aa6d-56c1bc559dd8","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"9ab01578-13a0-4a4d-aa6d-56c1bc559dd8","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"9ab01578-13a0-4a4d-aa6d-56c1bc559dd8","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"9ab01578-13a0-4a4d-aa6d-56c1bc559dd8"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"9ab01578-13a0-4a4d-aa6d-56c1bc559dd8","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":692097648,"seconds":1783442196}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":51248},"address":"10.133.0.32:51248"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"9ab01578-13a0-4a4d-aa6d-56c1bc559dd8","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9ab01578-13a0-4a4d-aa6d-56c1bc559dd8","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9ab01578-13a0-4a4d-aa6d-56c1bc559dd8","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6ee7c85e-4826-45ee-bbf6-2f506dc214b6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51262","PortSpecifier":{"PortValue":51262}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"6ee7c85e-4826-45ee-bbf6-2f506dc214b6","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6ee7c85e-4826-45ee-bbf6-2f506dc214b6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51262","PortSpecifier":{"PortValue":51262}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442196,"nanos":704396519},"http":{"id":"6ee7c85e-4826-45ee-bbf6-2f506dc214b6","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"6ee7c85e-4826-45ee-bbf6-2f506dc214b6","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"6ee7c85e-4826-45ee-bbf6-2f506dc214b6","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"6ee7c85e-4826-45ee-bbf6-2f506dc214b6","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"6ee7c85e-4826-45ee-bbf6-2f506dc214b6","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"6ee7c85e-4826-45ee-bbf6-2f506dc214b6"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"6ee7c85e-4826-45ee-bbf6-2f506dc214b6","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":704396519,"seconds":1783442196}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":51262},"address":"10.133.0.32:51262"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"6ee7c85e-4826-45ee-bbf6-2f506dc214b6","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6ee7c85e-4826-45ee-bbf6-2f506dc214b6","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6ee7c85e-4826-45ee-bbf6-2f506dc214b6","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"27dd31b9-21a6-4b81-a2b7-225a50a4c79b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51268","PortSpecifier":{"PortValue":51268}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"27dd31b9-21a6-4b81-a2b7-225a50a4c79b","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"27dd31b9-21a6-4b81-a2b7-225a50a4c79b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51268","PortSpecifier":{"PortValue":51268}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442196,"nanos":716433991},"http":{"id":"27dd31b9-21a6-4b81-a2b7-225a50a4c79b","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"27dd31b9-21a6-4b81-a2b7-225a50a4c79b","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"27dd31b9-21a6-4b81-a2b7-225a50a4c79b","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"27dd31b9-21a6-4b81-a2b7-225a50a4c79b","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"27dd31b9-21a6-4b81-a2b7-225a50a4c79b","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"27dd31b9-21a6-4b81-a2b7-225a50a4c79b"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"27dd31b9-21a6-4b81-a2b7-225a50a4c79b","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":716433991,"seconds":1783442196}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":51268},"address":"10.133.0.32:51268"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"27dd31b9-21a6-4b81-a2b7-225a50a4c79b","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"27dd31b9-21a6-4b81-a2b7-225a50a4c79b","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"27dd31b9-21a6-4b81-a2b7-225a50a4c79b","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b9a785b1-23ec-470d-ad2d-2e9baa5a0c67","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51284","PortSpecifier":{"PortValue":51284}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"b9a785b1-23ec-470d-ad2d-2e9baa5a0c67","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b9a785b1-23ec-470d-ad2d-2e9baa5a0c67","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51284","PortSpecifier":{"PortValue":51284}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442196,"nanos":727894302},"http":{"id":"b9a785b1-23ec-470d-ad2d-2e9baa5a0c67","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"b9a785b1-23ec-470d-ad2d-2e9baa5a0c67","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"b9a785b1-23ec-470d-ad2d-2e9baa5a0c67","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"b9a785b1-23ec-470d-ad2d-2e9baa5a0c67","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"b9a785b1-23ec-470d-ad2d-2e9baa5a0c67","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"b9a785b1-23ec-470d-ad2d-2e9baa5a0c67"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"b9a785b1-23ec-470d-ad2d-2e9baa5a0c67","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":727894302,"seconds":1783442196}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":51284},"address":"10.133.0.32:51284"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"b9a785b1-23ec-470d-ad2d-2e9baa5a0c67","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b9a785b1-23ec-470d-ad2d-2e9baa5a0c67","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b9a785b1-23ec-470d-ad2d-2e9baa5a0c67","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e4067d14-238b-4bd0-9891-0fa7bfbb6d02","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51290","PortSpecifier":{"PortValue":51290}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"e4067d14-238b-4bd0-9891-0fa7bfbb6d02","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e4067d14-238b-4bd0-9891-0fa7bfbb6d02","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51290","PortSpecifier":{"PortValue":51290}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442196,"nanos":740139109},"http":{"id":"e4067d14-238b-4bd0-9891-0fa7bfbb6d02","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"e4067d14-238b-4bd0-9891-0fa7bfbb6d02","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"e4067d14-238b-4bd0-9891-0fa7bfbb6d02","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"e4067d14-238b-4bd0-9891-0fa7bfbb6d02","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"e4067d14-238b-4bd0-9891-0fa7bfbb6d02","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"e4067d14-238b-4bd0-9891-0fa7bfbb6d02"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"e4067d14-238b-4bd0-9891-0fa7bfbb6d02","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":740139109,"seconds":1783442196}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":51290},"address":"10.133.0.32:51290"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"e4067d14-238b-4bd0-9891-0fa7bfbb6d02","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e4067d14-238b-4bd0-9891-0fa7bfbb6d02","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e4067d14-238b-4bd0-9891-0fa7bfbb6d02","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b4b6a3f5-9d03-4f19-8dbd-bea4dace2859","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51296","PortSpecifier":{"PortValue":51296}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"b4b6a3f5-9d03-4f19-8dbd-bea4dace2859","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b4b6a3f5-9d03-4f19-8dbd-bea4dace2859","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51296","PortSpecifier":{"PortValue":51296}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442196,"nanos":752023028},"http":{"id":"b4b6a3f5-9d03-4f19-8dbd-bea4dace2859","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"b4b6a3f5-9d03-4f19-8dbd-bea4dace2859","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"b4b6a3f5-9d03-4f19-8dbd-bea4dace2859","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"b4b6a3f5-9d03-4f19-8dbd-bea4dace2859","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"b4b6a3f5-9d03-4f19-8dbd-bea4dace2859","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"b4b6a3f5-9d03-4f19-8dbd-bea4dace2859"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"b4b6a3f5-9d03-4f19-8dbd-bea4dace2859","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":752023028,"seconds":1783442196}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":51296},"address":"10.133.0.32:51296"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"b4b6a3f5-9d03-4f19-8dbd-bea4dace2859","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b4b6a3f5-9d03-4f19-8dbd-bea4dace2859","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b4b6a3f5-9d03-4f19-8dbd-bea4dace2859","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9072fd62-2d4c-4eea-8d72-3fae901e386b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51300","PortSpecifier":{"PortValue":51300}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"9072fd62-2d4c-4eea-8d72-3fae901e386b","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9072fd62-2d4c-4eea-8d72-3fae901e386b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51300","PortSpecifier":{"PortValue":51300}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442196,"nanos":764090028},"http":{"id":"9072fd62-2d4c-4eea-8d72-3fae901e386b","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"9072fd62-2d4c-4eea-8d72-3fae901e386b","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"9072fd62-2d4c-4eea-8d72-3fae901e386b","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"9072fd62-2d4c-4eea-8d72-3fae901e386b","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"9072fd62-2d4c-4eea-8d72-3fae901e386b","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"9072fd62-2d4c-4eea-8d72-3fae901e386b"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"9072fd62-2d4c-4eea-8d72-3fae901e386b","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":764090028,"seconds":1783442196}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":51300},"address":"10.133.0.32:51300"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"9072fd62-2d4c-4eea-8d72-3fae901e386b","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9072fd62-2d4c-4eea-8d72-3fae901e386b","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9072fd62-2d4c-4eea-8d72-3fae901e386b","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2e4a6fc3-76b1-431f-b953-1d64310680a1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51306","PortSpecifier":{"PortValue":51306}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"2e4a6fc3-76b1-431f-b953-1d64310680a1","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2e4a6fc3-76b1-431f-b953-1d64310680a1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51306","PortSpecifier":{"PortValue":51306}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442196,"nanos":798135634},"http":{"id":"2e4a6fc3-76b1-431f-b953-1d64310680a1","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"2e4a6fc3-76b1-431f-b953-1d64310680a1","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"2e4a6fc3-76b1-431f-b953-1d64310680a1","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"2e4a6fc3-76b1-431f-b953-1d64310680a1","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"2e4a6fc3-76b1-431f-b953-1d64310680a1","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"2e4a6fc3-76b1-431f-b953-1d64310680a1"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"2e4a6fc3-76b1-431f-b953-1d64310680a1","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":798135634,"seconds":1783442196}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":51306},"address":"10.133.0.32:51306"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"2e4a6fc3-76b1-431f-b953-1d64310680a1","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2e4a6fc3-76b1-431f-b953-1d64310680a1","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2e4a6fc3-76b1-431f-b953-1d64310680a1","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"551c3871-f0df-47c9-94da-3d2d901d4ba5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51322","PortSpecifier":{"PortValue":51322}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"551c3871-f0df-47c9-94da-3d2d901d4ba5","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"551c3871-f0df-47c9-94da-3d2d901d4ba5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51322","PortSpecifier":{"PortValue":51322}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442196,"nanos":810956574},"http":{"id":"551c3871-f0df-47c9-94da-3d2d901d4ba5","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"551c3871-f0df-47c9-94da-3d2d901d4ba5","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"551c3871-f0df-47c9-94da-3d2d901d4ba5","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"551c3871-f0df-47c9-94da-3d2d901d4ba5","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"551c3871-f0df-47c9-94da-3d2d901d4ba5","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"551c3871-f0df-47c9-94da-3d2d901d4ba5"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"551c3871-f0df-47c9-94da-3d2d901d4ba5","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":810956574,"seconds":1783442196}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":51322},"address":"10.133.0.32:51322"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"551c3871-f0df-47c9-94da-3d2d901d4ba5","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"551c3871-f0df-47c9-94da-3d2d901d4ba5","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"551c3871-f0df-47c9-94da-3d2d901d4ba5","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"afddd56e-4912-48b5-bcbf-82a09d789899","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51328","PortSpecifier":{"PortValue":51328}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"afddd56e-4912-48b5-bcbf-82a09d789899","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"afddd56e-4912-48b5-bcbf-82a09d789899","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51328","PortSpecifier":{"PortValue":51328}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442196,"nanos":822960788},"http":{"id":"afddd56e-4912-48b5-bcbf-82a09d789899","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"afddd56e-4912-48b5-bcbf-82a09d789899","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"afddd56e-4912-48b5-bcbf-82a09d789899","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"afddd56e-4912-48b5-bcbf-82a09d789899","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"afddd56e-4912-48b5-bcbf-82a09d789899","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"afddd56e-4912-48b5-bcbf-82a09d789899"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"afddd56e-4912-48b5-bcbf-82a09d789899","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":822960788,"seconds":1783442196}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":51328},"address":"10.133.0.32:51328"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"afddd56e-4912-48b5-bcbf-82a09d789899","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"afddd56e-4912-48b5-bcbf-82a09d789899","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"afddd56e-4912-48b5-bcbf-82a09d789899","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"bb5f0697-27b5-474c-9f9b-de54af225853","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51342","PortSpecifier":{"PortValue":51342}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"bb5f0697-27b5-474c-9f9b-de54af225853","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"bb5f0697-27b5-474c-9f9b-de54af225853","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51342","PortSpecifier":{"PortValue":51342}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442196,"nanos":834736200},"http":{"id":"bb5f0697-27b5-474c-9f9b-de54af225853","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"bb5f0697-27b5-474c-9f9b-de54af225853","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"bb5f0697-27b5-474c-9f9b-de54af225853","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"bb5f0697-27b5-474c-9f9b-de54af225853","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"bb5f0697-27b5-474c-9f9b-de54af225853","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"bb5f0697-27b5-474c-9f9b-de54af225853"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"bb5f0697-27b5-474c-9f9b-de54af225853","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":834736200,"seconds":1783442196}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":51342},"address":"10.133.0.32:51342"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"bb5f0697-27b5-474c-9f9b-de54af225853","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"bb5f0697-27b5-474c-9f9b-de54af225853","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"bb5f0697-27b5-474c-9f9b-de54af225853","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9fac5ad4-a606-4f40-9ab8-3bbb3e5fd328","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51358","PortSpecifier":{"PortValue":51358}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"9fac5ad4-a606-4f40-9ab8-3bbb3e5fd328","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9fac5ad4-a606-4f40-9ab8-3bbb3e5fd328","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51358","PortSpecifier":{"PortValue":51358}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442196,"nanos":847303927},"http":{"id":"9fac5ad4-a606-4f40-9ab8-3bbb3e5fd328","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"9fac5ad4-a606-4f40-9ab8-3bbb3e5fd328","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"9fac5ad4-a606-4f40-9ab8-3bbb3e5fd328","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"9fac5ad4-a606-4f40-9ab8-3bbb3e5fd328","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"9fac5ad4-a606-4f40-9ab8-3bbb3e5fd328","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"9fac5ad4-a606-4f40-9ab8-3bbb3e5fd328"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"9fac5ad4-a606-4f40-9ab8-3bbb3e5fd328","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":847303927,"seconds":1783442196}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":51358},"address":"10.133.0.32:51358"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"9fac5ad4-a606-4f40-9ab8-3bbb3e5fd328","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9fac5ad4-a606-4f40-9ab8-3bbb3e5fd328","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9fac5ad4-a606-4f40-9ab8-3bbb3e5fd328","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2c094f3b-aa74-4260-b7a8-c14dabee0f0d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51368","PortSpecifier":{"PortValue":51368}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"2c094f3b-aa74-4260-b7a8-c14dabee0f0d","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2c094f3b-aa74-4260-b7a8-c14dabee0f0d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51368","PortSpecifier":{"PortValue":51368}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442196,"nanos":888080487},"http":{"id":"2c094f3b-aa74-4260-b7a8-c14dabee0f0d","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"2c094f3b-aa74-4260-b7a8-c14dabee0f0d","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"2c094f3b-aa74-4260-b7a8-c14dabee0f0d","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"2c094f3b-aa74-4260-b7a8-c14dabee0f0d","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"2c094f3b-aa74-4260-b7a8-c14dabee0f0d","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"2c094f3b-aa74-4260-b7a8-c14dabee0f0d"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"2c094f3b-aa74-4260-b7a8-c14dabee0f0d","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":888080487,"seconds":1783442196}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":51368},"address":"10.133.0.32:51368"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"2c094f3b-aa74-4260-b7a8-c14dabee0f0d","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2c094f3b-aa74-4260-b7a8-c14dabee0f0d","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2c094f3b-aa74-4260-b7a8-c14dabee0f0d","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3ecd4009-e9d6-4a5d-b562-c56a8aa3e675","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51370","PortSpecifier":{"PortValue":51370}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"3ecd4009-e9d6-4a5d-b562-c56a8aa3e675","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3ecd4009-e9d6-4a5d-b562-c56a8aa3e675","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51370","PortSpecifier":{"PortValue":51370}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442196,"nanos":900699758},"http":{"id":"3ecd4009-e9d6-4a5d-b562-c56a8aa3e675","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"3ecd4009-e9d6-4a5d-b562-c56a8aa3e675","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"3ecd4009-e9d6-4a5d-b562-c56a8aa3e675","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"3ecd4009-e9d6-4a5d-b562-c56a8aa3e675","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"3ecd4009-e9d6-4a5d-b562-c56a8aa3e675","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"3ecd4009-e9d6-4a5d-b562-c56a8aa3e675"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"3ecd4009-e9d6-4a5d-b562-c56a8aa3e675","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":900699758,"seconds":1783442196}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":51370},"address":"10.133.0.32:51370"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"3ecd4009-e9d6-4a5d-b562-c56a8aa3e675","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3ecd4009-e9d6-4a5d-b562-c56a8aa3e675","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3ecd4009-e9d6-4a5d-b562-c56a8aa3e675","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"767e6ce0-2ac0-4da9-8d6b-c6facf644431","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51380","PortSpecifier":{"PortValue":51380}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"767e6ce0-2ac0-4da9-8d6b-c6facf644431","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"767e6ce0-2ac0-4da9-8d6b-c6facf644431","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51380","PortSpecifier":{"PortValue":51380}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442196,"nanos":913111100},"http":{"id":"767e6ce0-2ac0-4da9-8d6b-c6facf644431","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"767e6ce0-2ac0-4da9-8d6b-c6facf644431","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"767e6ce0-2ac0-4da9-8d6b-c6facf644431","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"767e6ce0-2ac0-4da9-8d6b-c6facf644431","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"767e6ce0-2ac0-4da9-8d6b-c6facf644431","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"767e6ce0-2ac0-4da9-8d6b-c6facf644431"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"767e6ce0-2ac0-4da9-8d6b-c6facf644431","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":913111100,"seconds":1783442196}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":51380},"address":"10.133.0.32:51380"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"767e6ce0-2ac0-4da9-8d6b-c6facf644431","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"767e6ce0-2ac0-4da9-8d6b-c6facf644431","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"767e6ce0-2ac0-4da9-8d6b-c6facf644431","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0fa69144-7621-4c11-b6c4-b7974ed08f10","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51396","PortSpecifier":{"PortValue":51396}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"0fa69144-7621-4c11-b6c4-b7974ed08f10","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0fa69144-7621-4c11-b6c4-b7974ed08f10","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51396","PortSpecifier":{"PortValue":51396}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442196,"nanos":925719404},"http":{"id":"0fa69144-7621-4c11-b6c4-b7974ed08f10","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"0fa69144-7621-4c11-b6c4-b7974ed08f10","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"0fa69144-7621-4c11-b6c4-b7974ed08f10","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"0fa69144-7621-4c11-b6c4-b7974ed08f10","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"0fa69144-7621-4c11-b6c4-b7974ed08f10","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"0fa69144-7621-4c11-b6c4-b7974ed08f10"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"0fa69144-7621-4c11-b6c4-b7974ed08f10","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":925719404,"seconds":1783442196}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":51396},"address":"10.133.0.32:51396"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"0fa69144-7621-4c11-b6c4-b7974ed08f10","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0fa69144-7621-4c11-b6c4-b7974ed08f10","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0fa69144-7621-4c11-b6c4-b7974ed08f10","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"947ccc06-5a3f-43bd-8256-1979fb1d6252","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51410","PortSpecifier":{"PortValue":51410}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"947ccc06-5a3f-43bd-8256-1979fb1d6252","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"947ccc06-5a3f-43bd-8256-1979fb1d6252","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51410","PortSpecifier":{"PortValue":51410}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442196,"nanos":938619377},"http":{"id":"947ccc06-5a3f-43bd-8256-1979fb1d6252","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"947ccc06-5a3f-43bd-8256-1979fb1d6252","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"947ccc06-5a3f-43bd-8256-1979fb1d6252","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"947ccc06-5a3f-43bd-8256-1979fb1d6252","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"947ccc06-5a3f-43bd-8256-1979fb1d6252","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"947ccc06-5a3f-43bd-8256-1979fb1d6252"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"947ccc06-5a3f-43bd-8256-1979fb1d6252","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":938619377,"seconds":1783442196}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":51410},"address":"10.133.0.32:51410"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"947ccc06-5a3f-43bd-8256-1979fb1d6252","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"947ccc06-5a3f-43bd-8256-1979fb1d6252","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"947ccc06-5a3f-43bd-8256-1979fb1d6252","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d9ba5d00-5214-452b-9429-846ed974cfff","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51426","PortSpecifier":{"PortValue":51426}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"d9ba5d00-5214-452b-9429-846ed974cfff","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d9ba5d00-5214-452b-9429-846ed974cfff","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51426","PortSpecifier":{"PortValue":51426}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442196,"nanos":952123610},"http":{"id":"d9ba5d00-5214-452b-9429-846ed974cfff","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"d9ba5d00-5214-452b-9429-846ed974cfff","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"d9ba5d00-5214-452b-9429-846ed974cfff","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"d9ba5d00-5214-452b-9429-846ed974cfff","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"d9ba5d00-5214-452b-9429-846ed974cfff","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"d9ba5d00-5214-452b-9429-846ed974cfff"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"d9ba5d00-5214-452b-9429-846ed974cfff","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":952123610,"seconds":1783442196}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":51426},"address":"10.133.0.32:51426"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"d9ba5d00-5214-452b-9429-846ed974cfff","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d9ba5d00-5214-452b-9429-846ed974cfff","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d9ba5d00-5214-452b-9429-846ed974cfff","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"13882fb6-5375-4668-a609-8f03da25cd07","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51440","PortSpecifier":{"PortValue":51440}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"13882fb6-5375-4668-a609-8f03da25cd07","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"13882fb6-5375-4668-a609-8f03da25cd07","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51440","PortSpecifier":{"PortValue":51440}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442196,"nanos":966266283},"http":{"id":"13882fb6-5375-4668-a609-8f03da25cd07","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"13882fb6-5375-4668-a609-8f03da25cd07","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"13882fb6-5375-4668-a609-8f03da25cd07","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"13882fb6-5375-4668-a609-8f03da25cd07","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"13882fb6-5375-4668-a609-8f03da25cd07","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"13882fb6-5375-4668-a609-8f03da25cd07"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"13882fb6-5375-4668-a609-8f03da25cd07","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":966266283,"seconds":1783442196}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":51440},"address":"10.133.0.32:51440"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"13882fb6-5375-4668-a609-8f03da25cd07","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"13882fb6-5375-4668-a609-8f03da25cd07","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"13882fb6-5375-4668-a609-8f03da25cd07","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5a3ffbaa-0c54-4d1f-9753-8afb7a1530a0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51456","PortSpecifier":{"PortValue":51456}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"5a3ffbaa-0c54-4d1f-9753-8afb7a1530a0","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5a3ffbaa-0c54-4d1f-9753-8afb7a1530a0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51456","PortSpecifier":{"PortValue":51456}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442196,"nanos":990097845},"http":{"id":"5a3ffbaa-0c54-4d1f-9753-8afb7a1530a0","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"5a3ffbaa-0c54-4d1f-9753-8afb7a1530a0","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"5a3ffbaa-0c54-4d1f-9753-8afb7a1530a0","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"5a3ffbaa-0c54-4d1f-9753-8afb7a1530a0","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"5a3ffbaa-0c54-4d1f-9753-8afb7a1530a0","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"5a3ffbaa-0c54-4d1f-9753-8afb7a1530a0"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"5a3ffbaa-0c54-4d1f-9753-8afb7a1530a0","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":990097845,"seconds":1783442196}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":51456},"address":"10.133.0.32:51456"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"5a3ffbaa-0c54-4d1f-9753-8afb7a1530a0","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5a3ffbaa-0c54-4d1f-9753-8afb7a1530a0","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5a3ffbaa-0c54-4d1f-9753-8afb7a1530a0","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"193d70d7-d45f-4d2b-816b-b32d6f696872","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51466","PortSpecifier":{"PortValue":51466}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"193d70d7-d45f-4d2b-816b-b32d6f696872","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"193d70d7-d45f-4d2b-816b-b32d6f696872","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51466","PortSpecifier":{"PortValue":51466}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442197,"nanos":2379308},"http":{"id":"193d70d7-d45f-4d2b-816b-b32d6f696872","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"193d70d7-d45f-4d2b-816b-b32d6f696872","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"193d70d7-d45f-4d2b-816b-b32d6f696872","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"193d70d7-d45f-4d2b-816b-b32d6f696872","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"193d70d7-d45f-4d2b-816b-b32d6f696872","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"193d70d7-d45f-4d2b-816b-b32d6f696872"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"193d70d7-d45f-4d2b-816b-b32d6f696872","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":2379308,"seconds":1783442197}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":51466},"address":"10.133.0.32:51466"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"193d70d7-d45f-4d2b-816b-b32d6f696872","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"193d70d7-d45f-4d2b-816b-b32d6f696872","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"193d70d7-d45f-4d2b-816b-b32d6f696872","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8091ccb1-fc62-4f66-a753-dd8995827313","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51468","PortSpecifier":{"PortValue":51468}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"8091ccb1-fc62-4f66-a753-dd8995827313","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8091ccb1-fc62-4f66-a753-dd8995827313","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51468","PortSpecifier":{"PortValue":51468}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442197,"nanos":14316607},"http":{"id":"8091ccb1-fc62-4f66-a753-dd8995827313","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"8091ccb1-fc62-4f66-a753-dd8995827313","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"8091ccb1-fc62-4f66-a753-dd8995827313","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"8091ccb1-fc62-4f66-a753-dd8995827313","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"8091ccb1-fc62-4f66-a753-dd8995827313","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"8091ccb1-fc62-4f66-a753-dd8995827313"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"8091ccb1-fc62-4f66-a753-dd8995827313","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":14316607,"seconds":1783442197}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":51468},"address":"10.133.0.32:51468"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8091ccb1-fc62-4f66-a753-dd8995827313","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8091ccb1-fc62-4f66-a753-dd8995827313","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8091ccb1-fc62-4f66-a753-dd8995827313","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8091ccb1-fc62-4f66-a753-dd8995827313","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:maas-admin:tester-admin-user"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"8091ccb1-fc62-4f66-a753-dd8995827313","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8091ccb1-fc62-4f66-a753-dd8995827313","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:maas-admin\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8091ccb1-fc62-4f66-a753-dd8995827313","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8091ccb1-fc62-4f66-a753-dd8995827313","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8091ccb1-fc62-4f66-a753-dd8995827313","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"14900286-e800-4f1d-8631-c86c879ae432","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51480","PortSpecifier":{"PortValue":51480}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"14900286-e800-4f1d-8631-c86c879ae432","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"14900286-e800-4f1d-8631-c86c879ae432","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51480","PortSpecifier":{"PortValue":51480}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442197,"nanos":26778862},"http":{"id":"14900286-e800-4f1d-8631-c86c879ae432","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"14900286-e800-4f1d-8631-c86c879ae432","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"14900286-e800-4f1d-8631-c86c879ae432","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"14900286-e800-4f1d-8631-c86c879ae432","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"14900286-e800-4f1d-8631-c86c879ae432","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"14900286-e800-4f1d-8631-c86c879ae432"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"14900286-e800-4f1d-8631-c86c879ae432","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":26778862,"seconds":1783442197}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":51480},"address":"10.133.0.32:51480"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"14900286-e800-4f1d-8631-c86c879ae432","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"14900286-e800-4f1d-8631-c86c879ae432","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"14900286-e800-4f1d-8631-c86c879ae432","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"14900286-e800-4f1d-8631-c86c879ae432","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"14900286-e800-4f1d-8631-c86c879ae432","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:maas-admin\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"14900286-e800-4f1d-8631-c86c879ae432","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:maas-admin:tester-admin-user"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"14900286-e800-4f1d-8631-c86c879ae432","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"14900286-e800-4f1d-8631-c86c879ae432","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"14900286-e800-4f1d-8631-c86c879ae432","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"198093f3-a2b4-4537-92c9-c31eafb4d8d1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51490","PortSpecifier":{"PortValue":51490}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"198093f3-a2b4-4537-92c9-c31eafb4d8d1","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"198093f3-a2b4-4537-92c9-c31eafb4d8d1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51490","PortSpecifier":{"PortValue":51490}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442197,"nanos":39616160},"http":{"id":"198093f3-a2b4-4537-92c9-c31eafb4d8d1","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"198093f3-a2b4-4537-92c9-c31eafb4d8d1","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"198093f3-a2b4-4537-92c9-c31eafb4d8d1","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"198093f3-a2b4-4537-92c9-c31eafb4d8d1","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"198093f3-a2b4-4537-92c9-c31eafb4d8d1","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"198093f3-a2b4-4537-92c9-c31eafb4d8d1"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"198093f3-a2b4-4537-92c9-c31eafb4d8d1","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":39616160,"seconds":1783442197}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":51490},"address":"10.133.0.32:51490"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"198093f3-a2b4-4537-92c9-c31eafb4d8d1","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"198093f3-a2b4-4537-92c9-c31eafb4d8d1","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"198093f3-a2b4-4537-92c9-c31eafb4d8d1","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"198093f3-a2b4-4537-92c9-c31eafb4d8d1","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"198093f3-a2b4-4537-92c9-c31eafb4d8d1","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"198093f3-a2b4-4537-92c9-c31eafb4d8d1","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:maas-admin:tester-admin-user"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"198093f3-a2b4-4537-92c9-c31eafb4d8d1","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:maas-admin\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"198093f3-a2b4-4537-92c9-c31eafb4d8d1","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"198093f3-a2b4-4537-92c9-c31eafb4d8d1","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"46934327-4331-43bd-9159-4ed28ba6e83e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51494","PortSpecifier":{"PortValue":51494}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"46934327-4331-43bd-9159-4ed28ba6e83e","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"46934327-4331-43bd-9159-4ed28ba6e83e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51494","PortSpecifier":{"PortValue":51494}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442197,"nanos":52069706},"http":{"id":"46934327-4331-43bd-9159-4ed28ba6e83e","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"46934327-4331-43bd-9159-4ed28ba6e83e","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"46934327-4331-43bd-9159-4ed28ba6e83e","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"46934327-4331-43bd-9159-4ed28ba6e83e","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"46934327-4331-43bd-9159-4ed28ba6e83e","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"46934327-4331-43bd-9159-4ed28ba6e83e"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"46934327-4331-43bd-9159-4ed28ba6e83e","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":52069706,"seconds":1783442197}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":51494},"address":"10.133.0.32:51494"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"46934327-4331-43bd-9159-4ed28ba6e83e","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"46934327-4331-43bd-9159-4ed28ba6e83e","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"46934327-4331-43bd-9159-4ed28ba6e83e","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"46934327-4331-43bd-9159-4ed28ba6e83e","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:maas-admin:tester-admin-user"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"46934327-4331-43bd-9159-4ed28ba6e83e","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"46934327-4331-43bd-9159-4ed28ba6e83e","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:maas-admin\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"46934327-4331-43bd-9159-4ed28ba6e83e","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"46934327-4331-43bd-9159-4ed28ba6e83e","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"46934327-4331-43bd-9159-4ed28ba6e83e","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"63d2bcce-58fc-4188-9347-674b1afea5ef","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51508","PortSpecifier":{"PortValue":51508}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"63d2bcce-58fc-4188-9347-674b1afea5ef","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"63d2bcce-58fc-4188-9347-674b1afea5ef","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51508","PortSpecifier":{"PortValue":51508}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442197,"nanos":64111043},"http":{"id":"63d2bcce-58fc-4188-9347-674b1afea5ef","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"63d2bcce-58fc-4188-9347-674b1afea5ef","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"63d2bcce-58fc-4188-9347-674b1afea5ef","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"63d2bcce-58fc-4188-9347-674b1afea5ef","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"63d2bcce-58fc-4188-9347-674b1afea5ef","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"63d2bcce-58fc-4188-9347-674b1afea5ef"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"63d2bcce-58fc-4188-9347-674b1afea5ef","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":64111043,"seconds":1783442197}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":51508},"address":"10.133.0.32:51508"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"63d2bcce-58fc-4188-9347-674b1afea5ef","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"63d2bcce-58fc-4188-9347-674b1afea5ef","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"63d2bcce-58fc-4188-9347-674b1afea5ef","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"63d2bcce-58fc-4188-9347-674b1afea5ef","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:maas-admin:tester-admin-user"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"63d2bcce-58fc-4188-9347-674b1afea5ef","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"63d2bcce-58fc-4188-9347-674b1afea5ef","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"63d2bcce-58fc-4188-9347-674b1afea5ef","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:maas-admin\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"63d2bcce-58fc-4188-9347-674b1afea5ef","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"63d2bcce-58fc-4188-9347-674b1afea5ef","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"18792cb5-d8bd-46e5-8265-2a954aff1c17","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51512","PortSpecifier":{"PortValue":51512}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"18792cb5-d8bd-46e5-8265-2a954aff1c17","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"18792cb5-d8bd-46e5-8265-2a954aff1c17","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51512","PortSpecifier":{"PortValue":51512}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442197,"nanos":92614008},"http":{"id":"18792cb5-d8bd-46e5-8265-2a954aff1c17","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"18792cb5-d8bd-46e5-8265-2a954aff1c17","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"18792cb5-d8bd-46e5-8265-2a954aff1c17","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"18792cb5-d8bd-46e5-8265-2a954aff1c17","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"18792cb5-d8bd-46e5-8265-2a954aff1c17","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"18792cb5-d8bd-46e5-8265-2a954aff1c17"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"18792cb5-d8bd-46e5-8265-2a954aff1c17","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":92614008,"seconds":1783442197}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":51512},"address":"10.133.0.32:51512"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"18792cb5-d8bd-46e5-8265-2a954aff1c17","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"18792cb5-d8bd-46e5-8265-2a954aff1c17","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"18792cb5-d8bd-46e5-8265-2a954aff1c17","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"18792cb5-d8bd-46e5-8265-2a954aff1c17","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"18792cb5-d8bd-46e5-8265-2a954aff1c17","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:maas-admin:tester-admin-user"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"18792cb5-d8bd-46e5-8265-2a954aff1c17","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"18792cb5-d8bd-46e5-8265-2a954aff1c17","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:maas-admin\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"18792cb5-d8bd-46e5-8265-2a954aff1c17","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"18792cb5-d8bd-46e5-8265-2a954aff1c17","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"bff9b4a3-33b6-4e1c-957c-00fde6bd9cee","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51514","PortSpecifier":{"PortValue":51514}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"bff9b4a3-33b6-4e1c-957c-00fde6bd9cee","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"bff9b4a3-33b6-4e1c-957c-00fde6bd9cee","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51514","PortSpecifier":{"PortValue":51514}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442197,"nanos":104480718},"http":{"id":"bff9b4a3-33b6-4e1c-957c-00fde6bd9cee","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"bff9b4a3-33b6-4e1c-957c-00fde6bd9cee","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"bff9b4a3-33b6-4e1c-957c-00fde6bd9cee","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"bff9b4a3-33b6-4e1c-957c-00fde6bd9cee","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"bff9b4a3-33b6-4e1c-957c-00fde6bd9cee","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"bff9b4a3-33b6-4e1c-957c-00fde6bd9cee"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"bff9b4a3-33b6-4e1c-957c-00fde6bd9cee","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":104480718,"seconds":1783442197}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":51514},"address":"10.133.0.32:51514"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"bff9b4a3-33b6-4e1c-957c-00fde6bd9cee","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"bff9b4a3-33b6-4e1c-957c-00fde6bd9cee","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"bff9b4a3-33b6-4e1c-957c-00fde6bd9cee","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"bff9b4a3-33b6-4e1c-957c-00fde6bd9cee","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:maas-admin:tester-admin-user"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"bff9b4a3-33b6-4e1c-957c-00fde6bd9cee","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"bff9b4a3-33b6-4e1c-957c-00fde6bd9cee","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:maas-admin\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"bff9b4a3-33b6-4e1c-957c-00fde6bd9cee","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"bff9b4a3-33b6-4e1c-957c-00fde6bd9cee","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"bff9b4a3-33b6-4e1c-957c-00fde6bd9cee","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6499da16-1e54-4cbd-a34e-38741c678c3f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51522","PortSpecifier":{"PortValue":51522}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"6499da16-1e54-4cbd-a34e-38741c678c3f","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6499da16-1e54-4cbd-a34e-38741c678c3f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51522","PortSpecifier":{"PortValue":51522}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442197,"nanos":116387496},"http":{"id":"6499da16-1e54-4cbd-a34e-38741c678c3f","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"6499da16-1e54-4cbd-a34e-38741c678c3f","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"6499da16-1e54-4cbd-a34e-38741c678c3f","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"6499da16-1e54-4cbd-a34e-38741c678c3f","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"6499da16-1e54-4cbd-a34e-38741c678c3f","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"6499da16-1e54-4cbd-a34e-38741c678c3f"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"6499da16-1e54-4cbd-a34e-38741c678c3f","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":116387496,"seconds":1783442197}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":51522},"address":"10.133.0.32:51522"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6499da16-1e54-4cbd-a34e-38741c678c3f","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6499da16-1e54-4cbd-a34e-38741c678c3f","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6499da16-1e54-4cbd-a34e-38741c678c3f","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"6499da16-1e54-4cbd-a34e-38741c678c3f","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6499da16-1e54-4cbd-a34e-38741c678c3f","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6499da16-1e54-4cbd-a34e-38741c678c3f","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:maas-admin\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6499da16-1e54-4cbd-a34e-38741c678c3f","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:maas-admin:tester-admin-user"}
{"level":"info","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6499da16-1e54-4cbd-a34e-38741c678c3f","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6499da16-1e54-4cbd-a34e-38741c678c3f","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7cfc127a-f896-4abc-805b-cf330471a2f3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51532","PortSpecifier":{"PortValue":51532}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"7cfc127a-f896-4abc-805b-cf330471a2f3","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7cfc127a-f896-4abc-805b-cf330471a2f3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51532","PortSpecifier":{"PortValue":51532}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442197,"nanos":128491024},"http":{"id":"7cfc127a-f896-4abc-805b-cf330471a2f3","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"7cfc127a-f896-4abc-805b-cf330471a2f3","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"7cfc127a-f896-4abc-805b-cf330471a2f3","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"7cfc127a-f896-4abc-805b-cf330471a2f3","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"7cfc127a-f896-4abc-805b-cf330471a2f3","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"7cfc127a-f896-4abc-805b-cf330471a2f3"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"7cfc127a-f896-4abc-805b-cf330471a2f3","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":128491024,"seconds":1783442197}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":51532},"address":"10.133.0.32:51532"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7cfc127a-f896-4abc-805b-cf330471a2f3","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7cfc127a-f896-4abc-805b-cf330471a2f3","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7cfc127a-f896-4abc-805b-cf330471a2f3","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"7cfc127a-f896-4abc-805b-cf330471a2f3","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7cfc127a-f896-4abc-805b-cf330471a2f3","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:maas-admin:tester-admin-user"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7cfc127a-f896-4abc-805b-cf330471a2f3","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7cfc127a-f896-4abc-805b-cf330471a2f3","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:maas-admin\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7cfc127a-f896-4abc-805b-cf330471a2f3","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7cfc127a-f896-4abc-805b-cf330471a2f3","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"053f4e14-3a62-4126-9e46-09b3207eb776","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51538","PortSpecifier":{"PortValue":51538}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"053f4e14-3a62-4126-9e46-09b3207eb776","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"053f4e14-3a62-4126-9e46-09b3207eb776","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51538","PortSpecifier":{"PortValue":51538}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442197,"nanos":140296818},"http":{"id":"053f4e14-3a62-4126-9e46-09b3207eb776","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"053f4e14-3a62-4126-9e46-09b3207eb776","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"053f4e14-3a62-4126-9e46-09b3207eb776","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"053f4e14-3a62-4126-9e46-09b3207eb776","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"053f4e14-3a62-4126-9e46-09b3207eb776","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"053f4e14-3a62-4126-9e46-09b3207eb776"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"053f4e14-3a62-4126-9e46-09b3207eb776","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":140296818,"seconds":1783442197}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":51538},"address":"10.133.0.32:51538"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"053f4e14-3a62-4126-9e46-09b3207eb776","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"053f4e14-3a62-4126-9e46-09b3207eb776","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"053f4e14-3a62-4126-9e46-09b3207eb776","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"053f4e14-3a62-4126-9e46-09b3207eb776","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"053f4e14-3a62-4126-9e46-09b3207eb776","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"053f4e14-3a62-4126-9e46-09b3207eb776","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:maas-admin\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"053f4e14-3a62-4126-9e46-09b3207eb776","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:maas-admin:tester-admin-user"}
{"level":"info","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"053f4e14-3a62-4126-9e46-09b3207eb776","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"053f4e14-3a62-4126-9e46-09b3207eb776","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"fdf4a2c2-66ea-47bb-b164-754d8d6186f6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51554","PortSpecifier":{"PortValue":51554}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"fdf4a2c2-66ea-47bb-b164-754d8d6186f6","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"fdf4a2c2-66ea-47bb-b164-754d8d6186f6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51554","PortSpecifier":{"PortValue":51554}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442197,"nanos":152967840},"http":{"id":"fdf4a2c2-66ea-47bb-b164-754d8d6186f6","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"fdf4a2c2-66ea-47bb-b164-754d8d6186f6","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"fdf4a2c2-66ea-47bb-b164-754d8d6186f6","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"fdf4a2c2-66ea-47bb-b164-754d8d6186f6","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"fdf4a2c2-66ea-47bb-b164-754d8d6186f6","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"fdf4a2c2-66ea-47bb-b164-754d8d6186f6"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"fdf4a2c2-66ea-47bb-b164-754d8d6186f6","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":152967840,"seconds":1783442197}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":51554},"address":"10.133.0.32:51554"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fdf4a2c2-66ea-47bb-b164-754d8d6186f6","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fdf4a2c2-66ea-47bb-b164-754d8d6186f6","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fdf4a2c2-66ea-47bb-b164-754d8d6186f6","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"fdf4a2c2-66ea-47bb-b164-754d8d6186f6","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:maas-admin:tester-admin-user"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"fdf4a2c2-66ea-47bb-b164-754d8d6186f6","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"fdf4a2c2-66ea-47bb-b164-754d8d6186f6","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"fdf4a2c2-66ea-47bb-b164-754d8d6186f6","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:maas-admin\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"fdf4a2c2-66ea-47bb-b164-754d8d6186f6","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"fdf4a2c2-66ea-47bb-b164-754d8d6186f6","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"991c4ff8-2f7f-4020-a50a-90df964c096b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51568","PortSpecifier":{"PortValue":51568}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"991c4ff8-2f7f-4020-a50a-90df964c096b","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"991c4ff8-2f7f-4020-a50a-90df964c096b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51568","PortSpecifier":{"PortValue":51568}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442197,"nanos":192790885},"http":{"id":"991c4ff8-2f7f-4020-a50a-90df964c096b","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"991c4ff8-2f7f-4020-a50a-90df964c096b","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"991c4ff8-2f7f-4020-a50a-90df964c096b","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"991c4ff8-2f7f-4020-a50a-90df964c096b","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"991c4ff8-2f7f-4020-a50a-90df964c096b","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"991c4ff8-2f7f-4020-a50a-90df964c096b"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"991c4ff8-2f7f-4020-a50a-90df964c096b","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":192790885,"seconds":1783442197}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":51568},"address":"10.133.0.32:51568"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"991c4ff8-2f7f-4020-a50a-90df964c096b","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"991c4ff8-2f7f-4020-a50a-90df964c096b","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"991c4ff8-2f7f-4020-a50a-90df964c096b","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"991c4ff8-2f7f-4020-a50a-90df964c096b","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"991c4ff8-2f7f-4020-a50a-90df964c096b","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:maas-admin:tester-admin-user"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"991c4ff8-2f7f-4020-a50a-90df964c096b","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:maas-admin\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"991c4ff8-2f7f-4020-a50a-90df964c096b","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"991c4ff8-2f7f-4020-a50a-90df964c096b","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"991c4ff8-2f7f-4020-a50a-90df964c096b","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"577d90f9-0053-47f3-ab7e-b915f5ff0e9f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51582","PortSpecifier":{"PortValue":51582}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"577d90f9-0053-47f3-ab7e-b915f5ff0e9f","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"577d90f9-0053-47f3-ab7e-b915f5ff0e9f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51582","PortSpecifier":{"PortValue":51582}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442197,"nanos":205053520},"http":{"id":"577d90f9-0053-47f3-ab7e-b915f5ff0e9f","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"577d90f9-0053-47f3-ab7e-b915f5ff0e9f","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"577d90f9-0053-47f3-ab7e-b915f5ff0e9f","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"577d90f9-0053-47f3-ab7e-b915f5ff0e9f","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"577d90f9-0053-47f3-ab7e-b915f5ff0e9f","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"577d90f9-0053-47f3-ab7e-b915f5ff0e9f"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"577d90f9-0053-47f3-ab7e-b915f5ff0e9f","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":205053520,"seconds":1783442197}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":51582},"address":"10.133.0.32:51582"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"577d90f9-0053-47f3-ab7e-b915f5ff0e9f","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"577d90f9-0053-47f3-ab7e-b915f5ff0e9f","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"577d90f9-0053-47f3-ab7e-b915f5ff0e9f","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"577d90f9-0053-47f3-ab7e-b915f5ff0e9f","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"577d90f9-0053-47f3-ab7e-b915f5ff0e9f","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:maas-admin:tester-admin-user"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"577d90f9-0053-47f3-ab7e-b915f5ff0e9f","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"577d90f9-0053-47f3-ab7e-b915f5ff0e9f","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:maas-admin\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"577d90f9-0053-47f3-ab7e-b915f5ff0e9f","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"577d90f9-0053-47f3-ab7e-b915f5ff0e9f","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7e000d8f-ad33-486a-b4fb-2b61ac1f793f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51590","PortSpecifier":{"PortValue":51590}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"7e000d8f-ad33-486a-b4fb-2b61ac1f793f","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7e000d8f-ad33-486a-b4fb-2b61ac1f793f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51590","PortSpecifier":{"PortValue":51590}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442197,"nanos":217682535},"http":{"id":"7e000d8f-ad33-486a-b4fb-2b61ac1f793f","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"7e000d8f-ad33-486a-b4fb-2b61ac1f793f","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"7e000d8f-ad33-486a-b4fb-2b61ac1f793f","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"7e000d8f-ad33-486a-b4fb-2b61ac1f793f","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"7e000d8f-ad33-486a-b4fb-2b61ac1f793f","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"7e000d8f-ad33-486a-b4fb-2b61ac1f793f"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"7e000d8f-ad33-486a-b4fb-2b61ac1f793f","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":217682535,"seconds":1783442197}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":51590},"address":"10.133.0.32:51590"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7e000d8f-ad33-486a-b4fb-2b61ac1f793f","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7e000d8f-ad33-486a-b4fb-2b61ac1f793f","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7e000d8f-ad33-486a-b4fb-2b61ac1f793f","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"7e000d8f-ad33-486a-b4fb-2b61ac1f793f","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7e000d8f-ad33-486a-b4fb-2b61ac1f793f","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7e000d8f-ad33-486a-b4fb-2b61ac1f793f","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:maas-admin:tester-admin-user"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7e000d8f-ad33-486a-b4fb-2b61ac1f793f","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:maas-admin\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7e000d8f-ad33-486a-b4fb-2b61ac1f793f","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7e000d8f-ad33-486a-b4fb-2b61ac1f793f","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"147007f4-d0eb-410a-b5d3-ff4457abcc91","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51600","PortSpecifier":{"PortValue":51600}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"147007f4-d0eb-410a-b5d3-ff4457abcc91","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"147007f4-d0eb-410a-b5d3-ff4457abcc91","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51600","PortSpecifier":{"PortValue":51600}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442197,"nanos":229563261},"http":{"id":"147007f4-d0eb-410a-b5d3-ff4457abcc91","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"147007f4-d0eb-410a-b5d3-ff4457abcc91","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"147007f4-d0eb-410a-b5d3-ff4457abcc91","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"147007f4-d0eb-410a-b5d3-ff4457abcc91","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"147007f4-d0eb-410a-b5d3-ff4457abcc91","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"147007f4-d0eb-410a-b5d3-ff4457abcc91"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"147007f4-d0eb-410a-b5d3-ff4457abcc91","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":229563261,"seconds":1783442197}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":51600},"address":"10.133.0.32:51600"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"147007f4-d0eb-410a-b5d3-ff4457abcc91","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"147007f4-d0eb-410a-b5d3-ff4457abcc91","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"147007f4-d0eb-410a-b5d3-ff4457abcc91","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"147007f4-d0eb-410a-b5d3-ff4457abcc91","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:maas-admin:tester-admin-user"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"147007f4-d0eb-410a-b5d3-ff4457abcc91","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"147007f4-d0eb-410a-b5d3-ff4457abcc91","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"147007f4-d0eb-410a-b5d3-ff4457abcc91","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:maas-admin\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"147007f4-d0eb-410a-b5d3-ff4457abcc91","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"147007f4-d0eb-410a-b5d3-ff4457abcc91","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"750f7cbe-c86f-4802-a82c-02c676587b25","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51614","PortSpecifier":{"PortValue":51614}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"750f7cbe-c86f-4802-a82c-02c676587b25","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"750f7cbe-c86f-4802-a82c-02c676587b25","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51614","PortSpecifier":{"PortValue":51614}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442197,"nanos":241534198},"http":{"id":"750f7cbe-c86f-4802-a82c-02c676587b25","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"750f7cbe-c86f-4802-a82c-02c676587b25","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"750f7cbe-c86f-4802-a82c-02c676587b25","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"750f7cbe-c86f-4802-a82c-02c676587b25","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"750f7cbe-c86f-4802-a82c-02c676587b25","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"750f7cbe-c86f-4802-a82c-02c676587b25"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"750f7cbe-c86f-4802-a82c-02c676587b25","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":241534198,"seconds":1783442197}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":51614},"address":"10.133.0.32:51614"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"750f7cbe-c86f-4802-a82c-02c676587b25","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"750f7cbe-c86f-4802-a82c-02c676587b25","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"750f7cbe-c86f-4802-a82c-02c676587b25","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"750f7cbe-c86f-4802-a82c-02c676587b25","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:maas-admin:tester-admin-user"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"750f7cbe-c86f-4802-a82c-02c676587b25","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"750f7cbe-c86f-4802-a82c-02c676587b25","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"750f7cbe-c86f-4802-a82c-02c676587b25","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:maas-admin\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"750f7cbe-c86f-4802-a82c-02c676587b25","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"750f7cbe-c86f-4802-a82c-02c676587b25","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"fa305bcd-4c99-493b-9581-798419d8a94a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51622","PortSpecifier":{"PortValue":51622}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"fa305bcd-4c99-493b-9581-798419d8a94a","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"fa305bcd-4c99-493b-9581-798419d8a94a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51622","PortSpecifier":{"PortValue":51622}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442197,"nanos":253343487},"http":{"id":"fa305bcd-4c99-493b-9581-798419d8a94a","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"fa305bcd-4c99-493b-9581-798419d8a94a","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"fa305bcd-4c99-493b-9581-798419d8a94a","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"fa305bcd-4c99-493b-9581-798419d8a94a","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"fa305bcd-4c99-493b-9581-798419d8a94a","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"fa305bcd-4c99-493b-9581-798419d8a94a"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"fa305bcd-4c99-493b-9581-798419d8a94a","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":253343487,"seconds":1783442197}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":51622},"address":"10.133.0.32:51622"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fa305bcd-4c99-493b-9581-798419d8a94a","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fa305bcd-4c99-493b-9581-798419d8a94a","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fa305bcd-4c99-493b-9581-798419d8a94a","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"fa305bcd-4c99-493b-9581-798419d8a94a","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"fa305bcd-4c99-493b-9581-798419d8a94a","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:maas-admin:tester-admin-user"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"fa305bcd-4c99-493b-9581-798419d8a94a","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"fa305bcd-4c99-493b-9581-798419d8a94a","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:maas-admin\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"fa305bcd-4c99-493b-9581-798419d8a94a","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"fa305bcd-4c99-493b-9581-798419d8a94a","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0b2ac6d1-302d-4b9d-abc9-2de54fac211d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51636","PortSpecifier":{"PortValue":51636}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"0b2ac6d1-302d-4b9d-abc9-2de54fac211d","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0b2ac6d1-302d-4b9d-abc9-2de54fac211d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51636","PortSpecifier":{"PortValue":51636}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442197,"nanos":264925451},"http":{"id":"0b2ac6d1-302d-4b9d-abc9-2de54fac211d","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"0b2ac6d1-302d-4b9d-abc9-2de54fac211d","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"0b2ac6d1-302d-4b9d-abc9-2de54fac211d","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"0b2ac6d1-302d-4b9d-abc9-2de54fac211d","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"0b2ac6d1-302d-4b9d-abc9-2de54fac211d","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"0b2ac6d1-302d-4b9d-abc9-2de54fac211d"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"0b2ac6d1-302d-4b9d-abc9-2de54fac211d","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":264925451,"seconds":1783442197}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":51636},"address":"10.133.0.32:51636"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0b2ac6d1-302d-4b9d-abc9-2de54fac211d","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0b2ac6d1-302d-4b9d-abc9-2de54fac211d","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0b2ac6d1-302d-4b9d-abc9-2de54fac211d","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"0b2ac6d1-302d-4b9d-abc9-2de54fac211d","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0b2ac6d1-302d-4b9d-abc9-2de54fac211d","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:maas-admin:tester-admin-user"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0b2ac6d1-302d-4b9d-abc9-2de54fac211d","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0b2ac6d1-302d-4b9d-abc9-2de54fac211d","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:maas-admin\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0b2ac6d1-302d-4b9d-abc9-2de54fac211d","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0b2ac6d1-302d-4b9d-abc9-2de54fac211d","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"cb657df7-0284-405d-8ceb-e4eca4bcc75e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51644","PortSpecifier":{"PortValue":51644}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"cb657df7-0284-405d-8ceb-e4eca4bcc75e","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"cb657df7-0284-405d-8ceb-e4eca4bcc75e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51644","PortSpecifier":{"PortValue":51644}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442197,"nanos":292373616},"http":{"id":"cb657df7-0284-405d-8ceb-e4eca4bcc75e","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"cb657df7-0284-405d-8ceb-e4eca4bcc75e","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"cb657df7-0284-405d-8ceb-e4eca4bcc75e","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"cb657df7-0284-405d-8ceb-e4eca4bcc75e","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"cb657df7-0284-405d-8ceb-e4eca4bcc75e","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"cb657df7-0284-405d-8ceb-e4eca4bcc75e"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"cb657df7-0284-405d-8ceb-e4eca4bcc75e","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":292373616,"seconds":1783442197}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":51644},"address":"10.133.0.32:51644"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cb657df7-0284-405d-8ceb-e4eca4bcc75e","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cb657df7-0284-405d-8ceb-e4eca4bcc75e","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cb657df7-0284-405d-8ceb-e4eca4bcc75e","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"cb657df7-0284-405d-8ceb-e4eca4bcc75e","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cb657df7-0284-405d-8ceb-e4eca4bcc75e","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cb657df7-0284-405d-8ceb-e4eca4bcc75e","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:maas-admin:tester-admin-user"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cb657df7-0284-405d-8ceb-e4eca4bcc75e","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:maas-admin\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"cb657df7-0284-405d-8ceb-e4eca4bcc75e","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"cb657df7-0284-405d-8ceb-e4eca4bcc75e","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d8c0e1e4-aa14-400e-9721-609088148f0d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51660","PortSpecifier":{"PortValue":51660}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"d8c0e1e4-aa14-400e-9721-609088148f0d","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d8c0e1e4-aa14-400e-9721-609088148f0d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51660","PortSpecifier":{"PortValue":51660}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442197,"nanos":304191562},"http":{"id":"d8c0e1e4-aa14-400e-9721-609088148f0d","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"d8c0e1e4-aa14-400e-9721-609088148f0d","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"d8c0e1e4-aa14-400e-9721-609088148f0d","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"d8c0e1e4-aa14-400e-9721-609088148f0d","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"d8c0e1e4-aa14-400e-9721-609088148f0d","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"d8c0e1e4-aa14-400e-9721-609088148f0d"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"d8c0e1e4-aa14-400e-9721-609088148f0d","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":304191562,"seconds":1783442197}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":51660},"address":"10.133.0.32:51660"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d8c0e1e4-aa14-400e-9721-609088148f0d","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d8c0e1e4-aa14-400e-9721-609088148f0d","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d8c0e1e4-aa14-400e-9721-609088148f0d","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"d8c0e1e4-aa14-400e-9721-609088148f0d","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d8c0e1e4-aa14-400e-9721-609088148f0d","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d8c0e1e4-aa14-400e-9721-609088148f0d","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:maas-admin:tester-admin-user"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d8c0e1e4-aa14-400e-9721-609088148f0d","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:maas-admin\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d8c0e1e4-aa14-400e-9721-609088148f0d","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d8c0e1e4-aa14-400e-9721-609088148f0d","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"228986a0-e2b4-45b3-ab5c-b7ee050f31a3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51676","PortSpecifier":{"PortValue":51676}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"228986a0-e2b4-45b3-ab5c-b7ee050f31a3","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"228986a0-e2b4-45b3-ab5c-b7ee050f31a3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51676","PortSpecifier":{"PortValue":51676}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442197,"nanos":322112311},"http":{"id":"228986a0-e2b4-45b3-ab5c-b7ee050f31a3","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"228986a0-e2b4-45b3-ab5c-b7ee050f31a3","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"228986a0-e2b4-45b3-ab5c-b7ee050f31a3","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"228986a0-e2b4-45b3-ab5c-b7ee050f31a3","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"228986a0-e2b4-45b3-ab5c-b7ee050f31a3","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"228986a0-e2b4-45b3-ab5c-b7ee050f31a3"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"228986a0-e2b4-45b3-ab5c-b7ee050f31a3","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":322112311,"seconds":1783442197}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":51676},"address":"10.133.0.32:51676"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"228986a0-e2b4-45b3-ab5c-b7ee050f31a3","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"228986a0-e2b4-45b3-ab5c-b7ee050f31a3","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"228986a0-e2b4-45b3-ab5c-b7ee050f31a3","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"228986a0-e2b4-45b3-ab5c-b7ee050f31a3","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"228986a0-e2b4-45b3-ab5c-b7ee050f31a3","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"228986a0-e2b4-45b3-ab5c-b7ee050f31a3","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:maas-admin:tester-admin-user"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"228986a0-e2b4-45b3-ab5c-b7ee050f31a3","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:maas-admin\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"228986a0-e2b4-45b3-ab5c-b7ee050f31a3","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"228986a0-e2b4-45b3-ab5c-b7ee050f31a3","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2d5650ca-81db-442f-9644-7b6648619f92","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51688","PortSpecifier":{"PortValue":51688}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"2d5650ca-81db-442f-9644-7b6648619f92","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2d5650ca-81db-442f-9644-7b6648619f92","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51688","PortSpecifier":{"PortValue":51688}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442197,"nanos":335098629},"http":{"id":"2d5650ca-81db-442f-9644-7b6648619f92","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"2d5650ca-81db-442f-9644-7b6648619f92","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"2d5650ca-81db-442f-9644-7b6648619f92","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"2d5650ca-81db-442f-9644-7b6648619f92","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"2d5650ca-81db-442f-9644-7b6648619f92","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"2d5650ca-81db-442f-9644-7b6648619f92"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"2d5650ca-81db-442f-9644-7b6648619f92","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":335098629,"seconds":1783442197}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":51688},"address":"10.133.0.32:51688"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2d5650ca-81db-442f-9644-7b6648619f92","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2d5650ca-81db-442f-9644-7b6648619f92","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2d5650ca-81db-442f-9644-7b6648619f92","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2d5650ca-81db-442f-9644-7b6648619f92","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:maas-admin:tester-admin-user"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"2d5650ca-81db-442f-9644-7b6648619f92","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2d5650ca-81db-442f-9644-7b6648619f92","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2d5650ca-81db-442f-9644-7b6648619f92","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:maas-admin\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2d5650ca-81db-442f-9644-7b6648619f92","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2d5650ca-81db-442f-9644-7b6648619f92","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ef6e440f-6917-4795-804e-5d8b9465b3fb","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51700","PortSpecifier":{"PortValue":51700}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"ef6e440f-6917-4795-804e-5d8b9465b3fb","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ef6e440f-6917-4795-804e-5d8b9465b3fb","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51700","PortSpecifier":{"PortValue":51700}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442197,"nanos":347398090},"http":{"id":"ef6e440f-6917-4795-804e-5d8b9465b3fb","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"ef6e440f-6917-4795-804e-5d8b9465b3fb","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"ef6e440f-6917-4795-804e-5d8b9465b3fb","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"ef6e440f-6917-4795-804e-5d8b9465b3fb","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"ef6e440f-6917-4795-804e-5d8b9465b3fb","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"ef6e440f-6917-4795-804e-5d8b9465b3fb"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"ef6e440f-6917-4795-804e-5d8b9465b3fb","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":347398090,"seconds":1783442197}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":51700},"address":"10.133.0.32:51700"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ef6e440f-6917-4795-804e-5d8b9465b3fb","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ef6e440f-6917-4795-804e-5d8b9465b3fb","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ef6e440f-6917-4795-804e-5d8b9465b3fb","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"ef6e440f-6917-4795-804e-5d8b9465b3fb","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ef6e440f-6917-4795-804e-5d8b9465b3fb","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:maas-admin:tester-admin-user"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ef6e440f-6917-4795-804e-5d8b9465b3fb","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:maas-admin\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ef6e440f-6917-4795-804e-5d8b9465b3fb","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ef6e440f-6917-4795-804e-5d8b9465b3fb","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ef6e440f-6917-4795-804e-5d8b9465b3fb","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d78ea8a5-88e2-4661-9502-1c265a38f521","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51702","PortSpecifier":{"PortValue":51702}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"d78ea8a5-88e2-4661-9502-1c265a38f521","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d78ea8a5-88e2-4661-9502-1c265a38f521","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51702","PortSpecifier":{"PortValue":51702}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442197,"nanos":359290750},"http":{"id":"d78ea8a5-88e2-4661-9502-1c265a38f521","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"d78ea8a5-88e2-4661-9502-1c265a38f521","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"d78ea8a5-88e2-4661-9502-1c265a38f521","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"d78ea8a5-88e2-4661-9502-1c265a38f521","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"d78ea8a5-88e2-4661-9502-1c265a38f521","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"d78ea8a5-88e2-4661-9502-1c265a38f521"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"d78ea8a5-88e2-4661-9502-1c265a38f521","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":359290750,"seconds":1783442197}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":51702},"address":"10.133.0.32:51702"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d78ea8a5-88e2-4661-9502-1c265a38f521","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d78ea8a5-88e2-4661-9502-1c265a38f521","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d78ea8a5-88e2-4661-9502-1c265a38f521","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d78ea8a5-88e2-4661-9502-1c265a38f521","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:maas-admin:tester-admin-user"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"d78ea8a5-88e2-4661-9502-1c265a38f521","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d78ea8a5-88e2-4661-9502-1c265a38f521","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d78ea8a5-88e2-4661-9502-1c265a38f521","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:maas-admin\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d78ea8a5-88e2-4661-9502-1c265a38f521","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d78ea8a5-88e2-4661-9502-1c265a38f521","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"57c48ffd-f1d9-4743-a92c-692f60c2b225","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51718","PortSpecifier":{"PortValue":51718}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"57c48ffd-f1d9-4743-a92c-692f60c2b225","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"57c48ffd-f1d9-4743-a92c-692f60c2b225","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51718","PortSpecifier":{"PortValue":51718}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442197,"nanos":391993458},"http":{"id":"57c48ffd-f1d9-4743-a92c-692f60c2b225","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"57c48ffd-f1d9-4743-a92c-692f60c2b225","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"57c48ffd-f1d9-4743-a92c-692f60c2b225","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"57c48ffd-f1d9-4743-a92c-692f60c2b225","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"57c48ffd-f1d9-4743-a92c-692f60c2b225","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"57c48ffd-f1d9-4743-a92c-692f60c2b225"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"57c48ffd-f1d9-4743-a92c-692f60c2b225","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":391993458,"seconds":1783442197}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":51718},"address":"10.133.0.32:51718"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"57c48ffd-f1d9-4743-a92c-692f60c2b225","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"57c48ffd-f1d9-4743-a92c-692f60c2b225","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"57c48ffd-f1d9-4743-a92c-692f60c2b225","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"57c48ffd-f1d9-4743-a92c-692f60c2b225","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"57c48ffd-f1d9-4743-a92c-692f60c2b225","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:maas-admin:tester-admin-user"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"57c48ffd-f1d9-4743-a92c-692f60c2b225","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"57c48ffd-f1d9-4743-a92c-692f60c2b225","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:maas-admin\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"57c48ffd-f1d9-4743-a92c-692f60c2b225","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"57c48ffd-f1d9-4743-a92c-692f60c2b225","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ecabf012-6be9-4a9b-b172-ba5c47c899f4","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51724","PortSpecifier":{"PortValue":51724}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"ecabf012-6be9-4a9b-b172-ba5c47c899f4","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ecabf012-6be9-4a9b-b172-ba5c47c899f4","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51724","PortSpecifier":{"PortValue":51724}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442197,"nanos":405526188},"http":{"id":"ecabf012-6be9-4a9b-b172-ba5c47c899f4","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"ecabf012-6be9-4a9b-b172-ba5c47c899f4","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"ecabf012-6be9-4a9b-b172-ba5c47c899f4","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"ecabf012-6be9-4a9b-b172-ba5c47c899f4","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"ecabf012-6be9-4a9b-b172-ba5c47c899f4","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"ecabf012-6be9-4a9b-b172-ba5c47c899f4"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"ecabf012-6be9-4a9b-b172-ba5c47c899f4","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":405526188,"seconds":1783442197}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":51724},"address":"10.133.0.32:51724"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ecabf012-6be9-4a9b-b172-ba5c47c899f4","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ecabf012-6be9-4a9b-b172-ba5c47c899f4","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ecabf012-6be9-4a9b-b172-ba5c47c899f4","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"ecabf012-6be9-4a9b-b172-ba5c47c899f4","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ecabf012-6be9-4a9b-b172-ba5c47c899f4","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:maas-admin:tester-admin-user"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ecabf012-6be9-4a9b-b172-ba5c47c899f4","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ecabf012-6be9-4a9b-b172-ba5c47c899f4","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:maas-admin\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ecabf012-6be9-4a9b-b172-ba5c47c899f4","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ecabf012-6be9-4a9b-b172-ba5c47c899f4","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"67d7aac9-4564-4dd3-8382-9778ce1d8d47","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51736","PortSpecifier":{"PortValue":51736}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"67d7aac9-4564-4dd3-8382-9778ce1d8d47","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"67d7aac9-4564-4dd3-8382-9778ce1d8d47","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51736","PortSpecifier":{"PortValue":51736}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442197,"nanos":418876614},"http":{"id":"67d7aac9-4564-4dd3-8382-9778ce1d8d47","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"67d7aac9-4564-4dd3-8382-9778ce1d8d47","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"67d7aac9-4564-4dd3-8382-9778ce1d8d47","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"67d7aac9-4564-4dd3-8382-9778ce1d8d47","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"67d7aac9-4564-4dd3-8382-9778ce1d8d47","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"67d7aac9-4564-4dd3-8382-9778ce1d8d47"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"67d7aac9-4564-4dd3-8382-9778ce1d8d47","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":418876614,"seconds":1783442197}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":51736},"address":"10.133.0.32:51736"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"67d7aac9-4564-4dd3-8382-9778ce1d8d47","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"67d7aac9-4564-4dd3-8382-9778ce1d8d47","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"67d7aac9-4564-4dd3-8382-9778ce1d8d47","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"67d7aac9-4564-4dd3-8382-9778ce1d8d47","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:maas-admin:tester-admin-user"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"67d7aac9-4564-4dd3-8382-9778ce1d8d47","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"67d7aac9-4564-4dd3-8382-9778ce1d8d47","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:maas-admin\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"67d7aac9-4564-4dd3-8382-9778ce1d8d47","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"67d7aac9-4564-4dd3-8382-9778ce1d8d47","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"67d7aac9-4564-4dd3-8382-9778ce1d8d47","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7e194c85-af64-41c4-bdea-3db3c2685fee","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51748","PortSpecifier":{"PortValue":51748}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"7e194c85-af64-41c4-bdea-3db3c2685fee","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7e194c85-af64-41c4-bdea-3db3c2685fee","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51748","PortSpecifier":{"PortValue":51748}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442197,"nanos":431074078},"http":{"id":"7e194c85-af64-41c4-bdea-3db3c2685fee","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"7e194c85-af64-41c4-bdea-3db3c2685fee","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"7e194c85-af64-41c4-bdea-3db3c2685fee","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"7e194c85-af64-41c4-bdea-3db3c2685fee","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"7e194c85-af64-41c4-bdea-3db3c2685fee","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"7e194c85-af64-41c4-bdea-3db3c2685fee"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"7e194c85-af64-41c4-bdea-3db3c2685fee","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":431074078,"seconds":1783442197}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":51748},"address":"10.133.0.32:51748"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7e194c85-af64-41c4-bdea-3db3c2685fee","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7e194c85-af64-41c4-bdea-3db3c2685fee","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7e194c85-af64-41c4-bdea-3db3c2685fee","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"7e194c85-af64-41c4-bdea-3db3c2685fee","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7e194c85-af64-41c4-bdea-3db3c2685fee","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:maas-admin:tester-admin-user"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7e194c85-af64-41c4-bdea-3db3c2685fee","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:maas-admin\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7e194c85-af64-41c4-bdea-3db3c2685fee","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7e194c85-af64-41c4-bdea-3db3c2685fee","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7e194c85-af64-41c4-bdea-3db3c2685fee","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3232b6ca-805c-4db0-bdca-b1b6853e3ca7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51764","PortSpecifier":{"PortValue":51764}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"3232b6ca-805c-4db0-bdca-b1b6853e3ca7","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3232b6ca-805c-4db0-bdca-b1b6853e3ca7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51764","PortSpecifier":{"PortValue":51764}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442197,"nanos":443198646},"http":{"id":"3232b6ca-805c-4db0-bdca-b1b6853e3ca7","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"3232b6ca-805c-4db0-bdca-b1b6853e3ca7","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"3232b6ca-805c-4db0-bdca-b1b6853e3ca7","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"3232b6ca-805c-4db0-bdca-b1b6853e3ca7","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"3232b6ca-805c-4db0-bdca-b1b6853e3ca7","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"3232b6ca-805c-4db0-bdca-b1b6853e3ca7"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"3232b6ca-805c-4db0-bdca-b1b6853e3ca7","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":443198646,"seconds":1783442197}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":51764},"address":"10.133.0.32:51764"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3232b6ca-805c-4db0-bdca-b1b6853e3ca7","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3232b6ca-805c-4db0-bdca-b1b6853e3ca7","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3232b6ca-805c-4db0-bdca-b1b6853e3ca7","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"3232b6ca-805c-4db0-bdca-b1b6853e3ca7","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3232b6ca-805c-4db0-bdca-b1b6853e3ca7","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:maas-admin:tester-admin-user"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3232b6ca-805c-4db0-bdca-b1b6853e3ca7","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:maas-admin\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3232b6ca-805c-4db0-bdca-b1b6853e3ca7","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3232b6ca-805c-4db0-bdca-b1b6853e3ca7","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3232b6ca-805c-4db0-bdca-b1b6853e3ca7","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ade178d2-7266-432b-847f-a3e03c6e11d2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51780","PortSpecifier":{"PortValue":51780}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"ade178d2-7266-432b-847f-a3e03c6e11d2","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ade178d2-7266-432b-847f-a3e03c6e11d2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51780","PortSpecifier":{"PortValue":51780}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442197,"nanos":455288383},"http":{"id":"ade178d2-7266-432b-847f-a3e03c6e11d2","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"ade178d2-7266-432b-847f-a3e03c6e11d2","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"ade178d2-7266-432b-847f-a3e03c6e11d2","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"ade178d2-7266-432b-847f-a3e03c6e11d2","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"ade178d2-7266-432b-847f-a3e03c6e11d2","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"ade178d2-7266-432b-847f-a3e03c6e11d2"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"ade178d2-7266-432b-847f-a3e03c6e11d2","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":455288383,"seconds":1783442197}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":51780},"address":"10.133.0.32:51780"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ade178d2-7266-432b-847f-a3e03c6e11d2","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ade178d2-7266-432b-847f-a3e03c6e11d2","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ade178d2-7266-432b-847f-a3e03c6e11d2","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ade178d2-7266-432b-847f-a3e03c6e11d2","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:maas-admin:tester-admin-user"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"ade178d2-7266-432b-847f-a3e03c6e11d2","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ade178d2-7266-432b-847f-a3e03c6e11d2","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:maas-admin\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ade178d2-7266-432b-847f-a3e03c6e11d2","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ade178d2-7266-432b-847f-a3e03c6e11d2","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ade178d2-7266-432b-847f-a3e03c6e11d2","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"446af7bd-fa55-4a08-b227-9fd2381d3493","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51796","PortSpecifier":{"PortValue":51796}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"446af7bd-fa55-4a08-b227-9fd2381d3493","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"446af7bd-fa55-4a08-b227-9fd2381d3493","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51796","PortSpecifier":{"PortValue":51796}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442197,"nanos":467376060},"http":{"id":"446af7bd-fa55-4a08-b227-9fd2381d3493","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"446af7bd-fa55-4a08-b227-9fd2381d3493","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"446af7bd-fa55-4a08-b227-9fd2381d3493","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"446af7bd-fa55-4a08-b227-9fd2381d3493","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"446af7bd-fa55-4a08-b227-9fd2381d3493","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"446af7bd-fa55-4a08-b227-9fd2381d3493"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"446af7bd-fa55-4a08-b227-9fd2381d3493","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":467376060,"seconds":1783442197}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":51796},"address":"10.133.0.32:51796"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"446af7bd-fa55-4a08-b227-9fd2381d3493","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"446af7bd-fa55-4a08-b227-9fd2381d3493","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"446af7bd-fa55-4a08-b227-9fd2381d3493","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"446af7bd-fa55-4a08-b227-9fd2381d3493","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:maas-admin:tester-admin-user"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"446af7bd-fa55-4a08-b227-9fd2381d3493","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"446af7bd-fa55-4a08-b227-9fd2381d3493","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:maas-admin\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"446af7bd-fa55-4a08-b227-9fd2381d3493","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"446af7bd-fa55-4a08-b227-9fd2381d3493","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"446af7bd-fa55-4a08-b227-9fd2381d3493","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5668ebf6-0270-4e5d-a3d5-6b678a0eb824","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51800","PortSpecifier":{"PortValue":51800}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"5668ebf6-0270-4e5d-a3d5-6b678a0eb824","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5668ebf6-0270-4e5d-a3d5-6b678a0eb824","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51800","PortSpecifier":{"PortValue":51800}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442197,"nanos":492911844},"http":{"id":"5668ebf6-0270-4e5d-a3d5-6b678a0eb824","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"5668ebf6-0270-4e5d-a3d5-6b678a0eb824","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"5668ebf6-0270-4e5d-a3d5-6b678a0eb824","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"5668ebf6-0270-4e5d-a3d5-6b678a0eb824","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"5668ebf6-0270-4e5d-a3d5-6b678a0eb824","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"5668ebf6-0270-4e5d-a3d5-6b678a0eb824"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"5668ebf6-0270-4e5d-a3d5-6b678a0eb824","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":492911844,"seconds":1783442197}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":51800},"address":"10.133.0.32:51800"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5668ebf6-0270-4e5d-a3d5-6b678a0eb824","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5668ebf6-0270-4e5d-a3d5-6b678a0eb824","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5668ebf6-0270-4e5d-a3d5-6b678a0eb824","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"5668ebf6-0270-4e5d-a3d5-6b678a0eb824","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5668ebf6-0270-4e5d-a3d5-6b678a0eb824","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:maas-admin:tester-admin-user"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5668ebf6-0270-4e5d-a3d5-6b678a0eb824","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5668ebf6-0270-4e5d-a3d5-6b678a0eb824","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:maas-admin\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5668ebf6-0270-4e5d-a3d5-6b678a0eb824","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5668ebf6-0270-4e5d-a3d5-6b678a0eb824","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"13232701-1e54-4a99-b457-faf087140791","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51814","PortSpecifier":{"PortValue":51814}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"13232701-1e54-4a99-b457-faf087140791","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"13232701-1e54-4a99-b457-faf087140791","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51814","PortSpecifier":{"PortValue":51814}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442197,"nanos":505255030},"http":{"id":"13232701-1e54-4a99-b457-faf087140791","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"13232701-1e54-4a99-b457-faf087140791","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"13232701-1e54-4a99-b457-faf087140791","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"13232701-1e54-4a99-b457-faf087140791","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"13232701-1e54-4a99-b457-faf087140791","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"13232701-1e54-4a99-b457-faf087140791"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"13232701-1e54-4a99-b457-faf087140791","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":505255030,"seconds":1783442197}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":51814},"address":"10.133.0.32:51814"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"13232701-1e54-4a99-b457-faf087140791","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"13232701-1e54-4a99-b457-faf087140791","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"13232701-1e54-4a99-b457-faf087140791","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"13232701-1e54-4a99-b457-faf087140791","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"13232701-1e54-4a99-b457-faf087140791","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:maas-admin:tester-admin-user"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"13232701-1e54-4a99-b457-faf087140791","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:maas-admin\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"13232701-1e54-4a99-b457-faf087140791","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"13232701-1e54-4a99-b457-faf087140791","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"13232701-1e54-4a99-b457-faf087140791","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5942d6d0-3c57-4491-b3dc-dffd70af5fc1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51830","PortSpecifier":{"PortValue":51830}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"5942d6d0-3c57-4491-b3dc-dffd70af5fc1","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5942d6d0-3c57-4491-b3dc-dffd70af5fc1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51830","PortSpecifier":{"PortValue":51830}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442197,"nanos":516844894},"http":{"id":"5942d6d0-3c57-4491-b3dc-dffd70af5fc1","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"5942d6d0-3c57-4491-b3dc-dffd70af5fc1","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"5942d6d0-3c57-4491-b3dc-dffd70af5fc1","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"5942d6d0-3c57-4491-b3dc-dffd70af5fc1","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"5942d6d0-3c57-4491-b3dc-dffd70af5fc1","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"5942d6d0-3c57-4491-b3dc-dffd70af5fc1"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"5942d6d0-3c57-4491-b3dc-dffd70af5fc1","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":516844894,"seconds":1783442197}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":51830},"address":"10.133.0.32:51830"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5942d6d0-3c57-4491-b3dc-dffd70af5fc1","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5942d6d0-3c57-4491-b3dc-dffd70af5fc1","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:maas-admin\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"5942d6d0-3c57-4491-b3dc-dffd70af5fc1","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5942d6d0-3c57-4491-b3dc-dffd70af5fc1","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5942d6d0-3c57-4491-b3dc-dffd70af5fc1","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b56b1501-fd09-4c7d-a63a-e5d56e95f58f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51842","PortSpecifier":{"PortValue":51842}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"b56b1501-fd09-4c7d-a63a-e5d56e95f58f","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b56b1501-fd09-4c7d-a63a-e5d56e95f58f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51842","PortSpecifier":{"PortValue":51842}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442197,"nanos":529290790},"http":{"id":"b56b1501-fd09-4c7d-a63a-e5d56e95f58f","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"b56b1501-fd09-4c7d-a63a-e5d56e95f58f","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"b56b1501-fd09-4c7d-a63a-e5d56e95f58f","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"b56b1501-fd09-4c7d-a63a-e5d56e95f58f","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"b56b1501-fd09-4c7d-a63a-e5d56e95f58f","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"b56b1501-fd09-4c7d-a63a-e5d56e95f58f"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"b56b1501-fd09-4c7d-a63a-e5d56e95f58f","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":529290790,"seconds":1783442197}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":51842},"address":"10.133.0.32:51842"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"b56b1501-fd09-4c7d-a63a-e5d56e95f58f","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b56b1501-fd09-4c7d-a63a-e5d56e95f58f","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b56b1501-fd09-4c7d-a63a-e5d56e95f58f","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"48577402-360a-4699-9e1f-47a2b30ea8a9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51854","PortSpecifier":{"PortValue":51854}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"48577402-360a-4699-9e1f-47a2b30ea8a9","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"48577402-360a-4699-9e1f-47a2b30ea8a9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51854","PortSpecifier":{"PortValue":51854}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442197,"nanos":541671733},"http":{"id":"48577402-360a-4699-9e1f-47a2b30ea8a9","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"48577402-360a-4699-9e1f-47a2b30ea8a9","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"48577402-360a-4699-9e1f-47a2b30ea8a9","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"48577402-360a-4699-9e1f-47a2b30ea8a9","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"48577402-360a-4699-9e1f-47a2b30ea8a9","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"48577402-360a-4699-9e1f-47a2b30ea8a9"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"48577402-360a-4699-9e1f-47a2b30ea8a9","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":541671733,"seconds":1783442197}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":51854},"address":"10.133.0.32:51854"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"48577402-360a-4699-9e1f-47a2b30ea8a9","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"48577402-360a-4699-9e1f-47a2b30ea8a9","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"48577402-360a-4699-9e1f-47a2b30ea8a9","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0de693ff-460d-4fcd-87b1-3ec841cae25a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51866","PortSpecifier":{"PortValue":51866}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"0de693ff-460d-4fcd-87b1-3ec841cae25a","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0de693ff-460d-4fcd-87b1-3ec841cae25a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51866","PortSpecifier":{"PortValue":51866}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442197,"nanos":554749919},"http":{"id":"0de693ff-460d-4fcd-87b1-3ec841cae25a","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"0de693ff-460d-4fcd-87b1-3ec841cae25a","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"0de693ff-460d-4fcd-87b1-3ec841cae25a","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"0de693ff-460d-4fcd-87b1-3ec841cae25a","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"0de693ff-460d-4fcd-87b1-3ec841cae25a","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"0de693ff-460d-4fcd-87b1-3ec841cae25a"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"0de693ff-460d-4fcd-87b1-3ec841cae25a","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":554749919,"seconds":1783442197}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":51866},"address":"10.133.0.32:51866"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"0de693ff-460d-4fcd-87b1-3ec841cae25a","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0de693ff-460d-4fcd-87b1-3ec841cae25a","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0de693ff-460d-4fcd-87b1-3ec841cae25a","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"28a57e46-e2a1-4998-8598-fab92dba835b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51880","PortSpecifier":{"PortValue":51880}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"28a57e46-e2a1-4998-8598-fab92dba835b","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"28a57e46-e2a1-4998-8598-fab92dba835b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51880","PortSpecifier":{"PortValue":51880}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442197,"nanos":592369693},"http":{"id":"28a57e46-e2a1-4998-8598-fab92dba835b","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"28a57e46-e2a1-4998-8598-fab92dba835b","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"28a57e46-e2a1-4998-8598-fab92dba835b","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"28a57e46-e2a1-4998-8598-fab92dba835b","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"28a57e46-e2a1-4998-8598-fab92dba835b","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"28a57e46-e2a1-4998-8598-fab92dba835b"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"28a57e46-e2a1-4998-8598-fab92dba835b","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":592369693,"seconds":1783442197}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":51880},"address":"10.133.0.32:51880"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"28a57e46-e2a1-4998-8598-fab92dba835b","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"28a57e46-e2a1-4998-8598-fab92dba835b","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"28a57e46-e2a1-4998-8598-fab92dba835b","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"fb001d89-3216-46af-9a6d-2e06a3689303","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51884","PortSpecifier":{"PortValue":51884}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"fb001d89-3216-46af-9a6d-2e06a3689303","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"fb001d89-3216-46af-9a6d-2e06a3689303","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51884","PortSpecifier":{"PortValue":51884}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442197,"nanos":606285779},"http":{"id":"fb001d89-3216-46af-9a6d-2e06a3689303","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"fb001d89-3216-46af-9a6d-2e06a3689303","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"fb001d89-3216-46af-9a6d-2e06a3689303","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"fb001d89-3216-46af-9a6d-2e06a3689303","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"fb001d89-3216-46af-9a6d-2e06a3689303","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"fb001d89-3216-46af-9a6d-2e06a3689303"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"fb001d89-3216-46af-9a6d-2e06a3689303","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":606285779,"seconds":1783442197}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":51884},"address":"10.133.0.32:51884"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"fb001d89-3216-46af-9a6d-2e06a3689303","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"fb001d89-3216-46af-9a6d-2e06a3689303","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"fb001d89-3216-46af-9a6d-2e06a3689303","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c5e37210-e68d-44a3-a00a-0cde5255f8c9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51892","PortSpecifier":{"PortValue":51892}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"c5e37210-e68d-44a3-a00a-0cde5255f8c9","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c5e37210-e68d-44a3-a00a-0cde5255f8c9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51892","PortSpecifier":{"PortValue":51892}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442197,"nanos":619586584},"http":{"id":"c5e37210-e68d-44a3-a00a-0cde5255f8c9","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"c5e37210-e68d-44a3-a00a-0cde5255f8c9","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"c5e37210-e68d-44a3-a00a-0cde5255f8c9","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"c5e37210-e68d-44a3-a00a-0cde5255f8c9","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"c5e37210-e68d-44a3-a00a-0cde5255f8c9","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"c5e37210-e68d-44a3-a00a-0cde5255f8c9"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"c5e37210-e68d-44a3-a00a-0cde5255f8c9","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":619586584,"seconds":1783442197}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":51892},"address":"10.133.0.32:51892"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"c5e37210-e68d-44a3-a00a-0cde5255f8c9","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c5e37210-e68d-44a3-a00a-0cde5255f8c9","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c5e37210-e68d-44a3-a00a-0cde5255f8c9","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"59e23bb5-d3c1-4d64-a726-e8345eccbf24","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51906","PortSpecifier":{"PortValue":51906}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"59e23bb5-d3c1-4d64-a726-e8345eccbf24","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"59e23bb5-d3c1-4d64-a726-e8345eccbf24","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51906","PortSpecifier":{"PortValue":51906}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442197,"nanos":632565486},"http":{"id":"59e23bb5-d3c1-4d64-a726-e8345eccbf24","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"59e23bb5-d3c1-4d64-a726-e8345eccbf24","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"59e23bb5-d3c1-4d64-a726-e8345eccbf24","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"59e23bb5-d3c1-4d64-a726-e8345eccbf24","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"59e23bb5-d3c1-4d64-a726-e8345eccbf24","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"59e23bb5-d3c1-4d64-a726-e8345eccbf24"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"59e23bb5-d3c1-4d64-a726-e8345eccbf24","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":632565486,"seconds":1783442197}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":51906},"address":"10.133.0.32:51906"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"59e23bb5-d3c1-4d64-a726-e8345eccbf24","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"59e23bb5-d3c1-4d64-a726-e8345eccbf24","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"59e23bb5-d3c1-4d64-a726-e8345eccbf24","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ea65652d-9006-40a2-9ef0-4c4cf40c5e8a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51910","PortSpecifier":{"PortValue":51910}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"ea65652d-9006-40a2-9ef0-4c4cf40c5e8a","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ea65652d-9006-40a2-9ef0-4c4cf40c5e8a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51910","PortSpecifier":{"PortValue":51910}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442197,"nanos":645133983},"http":{"id":"ea65652d-9006-40a2-9ef0-4c4cf40c5e8a","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"ea65652d-9006-40a2-9ef0-4c4cf40c5e8a","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"ea65652d-9006-40a2-9ef0-4c4cf40c5e8a","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"ea65652d-9006-40a2-9ef0-4c4cf40c5e8a","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"ea65652d-9006-40a2-9ef0-4c4cf40c5e8a","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"ea65652d-9006-40a2-9ef0-4c4cf40c5e8a"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"ea65652d-9006-40a2-9ef0-4c4cf40c5e8a","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":645133983,"seconds":1783442197}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":51910},"address":"10.133.0.32:51910"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"ea65652d-9006-40a2-9ef0-4c4cf40c5e8a","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ea65652d-9006-40a2-9ef0-4c4cf40c5e8a","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ea65652d-9006-40a2-9ef0-4c4cf40c5e8a","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"bf168eeb-ff8d-4a33-8d62-7395ab318c9f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51916","PortSpecifier":{"PortValue":51916}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"bf168eeb-ff8d-4a33-8d62-7395ab318c9f","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"bf168eeb-ff8d-4a33-8d62-7395ab318c9f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51916","PortSpecifier":{"PortValue":51916}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442197,"nanos":658016357},"http":{"id":"bf168eeb-ff8d-4a33-8d62-7395ab318c9f","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"bf168eeb-ff8d-4a33-8d62-7395ab318c9f","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"bf168eeb-ff8d-4a33-8d62-7395ab318c9f","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"bf168eeb-ff8d-4a33-8d62-7395ab318c9f","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"bf168eeb-ff8d-4a33-8d62-7395ab318c9f","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"bf168eeb-ff8d-4a33-8d62-7395ab318c9f"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"bf168eeb-ff8d-4a33-8d62-7395ab318c9f","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":658016357,"seconds":1783442197}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":51916},"address":"10.133.0.32:51916"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"bf168eeb-ff8d-4a33-8d62-7395ab318c9f","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"bf168eeb-ff8d-4a33-8d62-7395ab318c9f","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"bf168eeb-ff8d-4a33-8d62-7395ab318c9f","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"4e6a678f-f197-45dc-8f1c-9dca68ce1aeb","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51926","PortSpecifier":{"PortValue":51926}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"4e6a678f-f197-45dc-8f1c-9dca68ce1aeb","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"4e6a678f-f197-45dc-8f1c-9dca68ce1aeb","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51926","PortSpecifier":{"PortValue":51926}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442197,"nanos":688356317},"http":{"id":"4e6a678f-f197-45dc-8f1c-9dca68ce1aeb","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"4e6a678f-f197-45dc-8f1c-9dca68ce1aeb","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"4e6a678f-f197-45dc-8f1c-9dca68ce1aeb","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"4e6a678f-f197-45dc-8f1c-9dca68ce1aeb","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"4e6a678f-f197-45dc-8f1c-9dca68ce1aeb","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"4e6a678f-f197-45dc-8f1c-9dca68ce1aeb"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"4e6a678f-f197-45dc-8f1c-9dca68ce1aeb","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":688356317,"seconds":1783442197}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":51926},"address":"10.133.0.32:51926"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"4e6a678f-f197-45dc-8f1c-9dca68ce1aeb","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4e6a678f-f197-45dc-8f1c-9dca68ce1aeb","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4e6a678f-f197-45dc-8f1c-9dca68ce1aeb","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"bbd457aa-e3c5-4fc2-adf6-5ee49586b195","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51940","PortSpecifier":{"PortValue":51940}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"bbd457aa-e3c5-4fc2-adf6-5ee49586b195","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"bbd457aa-e3c5-4fc2-adf6-5ee49586b195","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51940","PortSpecifier":{"PortValue":51940}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442197,"nanos":700770387},"http":{"id":"bbd457aa-e3c5-4fc2-adf6-5ee49586b195","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"bbd457aa-e3c5-4fc2-adf6-5ee49586b195","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"bbd457aa-e3c5-4fc2-adf6-5ee49586b195","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"bbd457aa-e3c5-4fc2-adf6-5ee49586b195","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"bbd457aa-e3c5-4fc2-adf6-5ee49586b195","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"bbd457aa-e3c5-4fc2-adf6-5ee49586b195"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"bbd457aa-e3c5-4fc2-adf6-5ee49586b195","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":700770387,"seconds":1783442197}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":51940},"address":"10.133.0.32:51940"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"bbd457aa-e3c5-4fc2-adf6-5ee49586b195","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"bbd457aa-e3c5-4fc2-adf6-5ee49586b195","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"bbd457aa-e3c5-4fc2-adf6-5ee49586b195","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2713f409-3918-4f71-924b-adbc8cbc0fa3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51952","PortSpecifier":{"PortValue":51952}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"2713f409-3918-4f71-924b-adbc8cbc0fa3","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2713f409-3918-4f71-924b-adbc8cbc0fa3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51952","PortSpecifier":{"PortValue":51952}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442197,"nanos":713481990},"http":{"id":"2713f409-3918-4f71-924b-adbc8cbc0fa3","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"2713f409-3918-4f71-924b-adbc8cbc0fa3","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"2713f409-3918-4f71-924b-adbc8cbc0fa3","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"2713f409-3918-4f71-924b-adbc8cbc0fa3","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"2713f409-3918-4f71-924b-adbc8cbc0fa3","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"2713f409-3918-4f71-924b-adbc8cbc0fa3"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"2713f409-3918-4f71-924b-adbc8cbc0fa3","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":713481990,"seconds":1783442197}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":51952},"address":"10.133.0.32:51952"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"2713f409-3918-4f71-924b-adbc8cbc0fa3","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2713f409-3918-4f71-924b-adbc8cbc0fa3","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2713f409-3918-4f71-924b-adbc8cbc0fa3","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c0f785b3-13cf-4b90-988b-f6ff838cff78","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51964","PortSpecifier":{"PortValue":51964}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"c0f785b3-13cf-4b90-988b-f6ff838cff78","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c0f785b3-13cf-4b90-988b-f6ff838cff78","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51964","PortSpecifier":{"PortValue":51964}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442197,"nanos":726448628},"http":{"id":"c0f785b3-13cf-4b90-988b-f6ff838cff78","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"c0f785b3-13cf-4b90-988b-f6ff838cff78","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"c0f785b3-13cf-4b90-988b-f6ff838cff78","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"c0f785b3-13cf-4b90-988b-f6ff838cff78","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"c0f785b3-13cf-4b90-988b-f6ff838cff78","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"c0f785b3-13cf-4b90-988b-f6ff838cff78"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"c0f785b3-13cf-4b90-988b-f6ff838cff78","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":726448628,"seconds":1783442197}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":51964},"address":"10.133.0.32:51964"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"c0f785b3-13cf-4b90-988b-f6ff838cff78","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c0f785b3-13cf-4b90-988b-f6ff838cff78","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c0f785b3-13cf-4b90-988b-f6ff838cff78","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b93e2fdb-fc59-4c7f-a7d7-a7492f0e092e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51976","PortSpecifier":{"PortValue":51976}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"b93e2fdb-fc59-4c7f-a7d7-a7492f0e092e","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b93e2fdb-fc59-4c7f-a7d7-a7492f0e092e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51976","PortSpecifier":{"PortValue":51976}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442197,"nanos":739056586},"http":{"id":"b93e2fdb-fc59-4c7f-a7d7-a7492f0e092e","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"b93e2fdb-fc59-4c7f-a7d7-a7492f0e092e","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"b93e2fdb-fc59-4c7f-a7d7-a7492f0e092e","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"b93e2fdb-fc59-4c7f-a7d7-a7492f0e092e","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"b93e2fdb-fc59-4c7f-a7d7-a7492f0e092e","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"b93e2fdb-fc59-4c7f-a7d7-a7492f0e092e"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"b93e2fdb-fc59-4c7f-a7d7-a7492f0e092e","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":739056586,"seconds":1783442197}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":51976},"address":"10.133.0.32:51976"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"b93e2fdb-fc59-4c7f-a7d7-a7492f0e092e","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b93e2fdb-fc59-4c7f-a7d7-a7492f0e092e","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b93e2fdb-fc59-4c7f-a7d7-a7492f0e092e","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c299df87-4724-44fb-b6c5-284ffc061a87","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51984","PortSpecifier":{"PortValue":51984}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"c299df87-4724-44fb-b6c5-284ffc061a87","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c299df87-4724-44fb-b6c5-284ffc061a87","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51984","PortSpecifier":{"PortValue":51984}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442197,"nanos":751311510},"http":{"id":"c299df87-4724-44fb-b6c5-284ffc061a87","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"c299df87-4724-44fb-b6c5-284ffc061a87","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"c299df87-4724-44fb-b6c5-284ffc061a87","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"c299df87-4724-44fb-b6c5-284ffc061a87","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"c299df87-4724-44fb-b6c5-284ffc061a87","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"c299df87-4724-44fb-b6c5-284ffc061a87"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"c299df87-4724-44fb-b6c5-284ffc061a87","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":751311510,"seconds":1783442197}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":51984},"address":"10.133.0.32:51984"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"c299df87-4724-44fb-b6c5-284ffc061a87","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c299df87-4724-44fb-b6c5-284ffc061a87","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c299df87-4724-44fb-b6c5-284ffc061a87","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d31fda06-21f7-957f-b608-7624835a51ab","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51992","PortSpecifier":{"PortValue":51992}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"d31fda06-21f7-957f-b608-7624835a51ab","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d31fda06-21f7-957f-b608-7624835a51ab","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51992","PortSpecifier":{"PortValue":51992}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442197,"nanos":763797283},"http":{"id":"d31fda06-21f7-957f-b608-7624835a51ab","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"d31fda06-21f7-957f-b608-7624835a51ab","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"d31fda06-21f7-957f-b608-7624835a51ab","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"d31fda06-21f7-957f-b608-7624835a51ab","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"d31fda06-21f7-957f-b608-7624835a51ab","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"d31fda06-21f7-957f-b608-7624835a51ab"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"d31fda06-21f7-957f-b608-7624835a51ab","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":763797283,"seconds":1783442197}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":51992},"address":"10.133.0.32:51992"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"d31fda06-21f7-957f-b608-7624835a51ab","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d31fda06-21f7-957f-b608-7624835a51ab","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d31fda06-21f7-957f-b608-7624835a51ab","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"967c5f44-1964-4a12-9d55-cb7cfc8b56e8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51994","PortSpecifier":{"PortValue":51994}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"967c5f44-1964-4a12-9d55-cb7cfc8b56e8","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"967c5f44-1964-4a12-9d55-cb7cfc8b56e8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:51994","PortSpecifier":{"PortValue":51994}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442197,"nanos":792171762},"http":{"id":"967c5f44-1964-4a12-9d55-cb7cfc8b56e8","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"967c5f44-1964-4a12-9d55-cb7cfc8b56e8","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"967c5f44-1964-4a12-9d55-cb7cfc8b56e8","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"967c5f44-1964-4a12-9d55-cb7cfc8b56e8","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"967c5f44-1964-4a12-9d55-cb7cfc8b56e8","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"967c5f44-1964-4a12-9d55-cb7cfc8b56e8"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"967c5f44-1964-4a12-9d55-cb7cfc8b56e8","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":792171762,"seconds":1783442197}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":51994},"address":"10.133.0.32:51994"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"967c5f44-1964-4a12-9d55-cb7cfc8b56e8","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"967c5f44-1964-4a12-9d55-cb7cfc8b56e8","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"967c5f44-1964-4a12-9d55-cb7cfc8b56e8","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"baaced3c-6aff-44cd-8121-cb2fb83771fa","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52004","PortSpecifier":{"PortValue":52004}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"baaced3c-6aff-44cd-8121-cb2fb83771fa","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"baaced3c-6aff-44cd-8121-cb2fb83771fa","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52004","PortSpecifier":{"PortValue":52004}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442197,"nanos":805012655},"http":{"id":"baaced3c-6aff-44cd-8121-cb2fb83771fa","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"baaced3c-6aff-44cd-8121-cb2fb83771fa","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"baaced3c-6aff-44cd-8121-cb2fb83771fa","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"baaced3c-6aff-44cd-8121-cb2fb83771fa","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"baaced3c-6aff-44cd-8121-cb2fb83771fa","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"baaced3c-6aff-44cd-8121-cb2fb83771fa"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"baaced3c-6aff-44cd-8121-cb2fb83771fa","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":805012655,"seconds":1783442197}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":52004},"address":"10.133.0.32:52004"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"baaced3c-6aff-44cd-8121-cb2fb83771fa","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"baaced3c-6aff-44cd-8121-cb2fb83771fa","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"baaced3c-6aff-44cd-8121-cb2fb83771fa","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5e53c614-0c55-4356-b6e0-c85d1070eceb","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52008","PortSpecifier":{"PortValue":52008}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"5e53c614-0c55-4356-b6e0-c85d1070eceb","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5e53c614-0c55-4356-b6e0-c85d1070eceb","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52008","PortSpecifier":{"PortValue":52008}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442197,"nanos":816878265},"http":{"id":"5e53c614-0c55-4356-b6e0-c85d1070eceb","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"5e53c614-0c55-4356-b6e0-c85d1070eceb","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"5e53c614-0c55-4356-b6e0-c85d1070eceb","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"5e53c614-0c55-4356-b6e0-c85d1070eceb","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"5e53c614-0c55-4356-b6e0-c85d1070eceb","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"5e53c614-0c55-4356-b6e0-c85d1070eceb"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"5e53c614-0c55-4356-b6e0-c85d1070eceb","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":816878265,"seconds":1783442197}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":52008},"address":"10.133.0.32:52008"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"5e53c614-0c55-4356-b6e0-c85d1070eceb","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5e53c614-0c55-4356-b6e0-c85d1070eceb","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5e53c614-0c55-4356-b6e0-c85d1070eceb","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"22767bb2-25a2-42e9-8a59-98fc9e87996f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52022","PortSpecifier":{"PortValue":52022}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"22767bb2-25a2-42e9-8a59-98fc9e87996f","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"22767bb2-25a2-42e9-8a59-98fc9e87996f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52022","PortSpecifier":{"PortValue":52022}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442197,"nanos":828826428},"http":{"id":"22767bb2-25a2-42e9-8a59-98fc9e87996f","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"22767bb2-25a2-42e9-8a59-98fc9e87996f","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"22767bb2-25a2-42e9-8a59-98fc9e87996f","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"22767bb2-25a2-42e9-8a59-98fc9e87996f","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"22767bb2-25a2-42e9-8a59-98fc9e87996f","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"22767bb2-25a2-42e9-8a59-98fc9e87996f"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"22767bb2-25a2-42e9-8a59-98fc9e87996f","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":828826428,"seconds":1783442197}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":52022},"address":"10.133.0.32:52022"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"22767bb2-25a2-42e9-8a59-98fc9e87996f","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"22767bb2-25a2-42e9-8a59-98fc9e87996f","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"22767bb2-25a2-42e9-8a59-98fc9e87996f","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ad70e911-656d-44c8-aa82-a335c75662ed","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52034","PortSpecifier":{"PortValue":52034}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"ad70e911-656d-44c8-aa82-a335c75662ed","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ad70e911-656d-44c8-aa82-a335c75662ed","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52034","PortSpecifier":{"PortValue":52034}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442197,"nanos":841258154},"http":{"id":"ad70e911-656d-44c8-aa82-a335c75662ed","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"ad70e911-656d-44c8-aa82-a335c75662ed","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"ad70e911-656d-44c8-aa82-a335c75662ed","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"ad70e911-656d-44c8-aa82-a335c75662ed","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"ad70e911-656d-44c8-aa82-a335c75662ed","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"ad70e911-656d-44c8-aa82-a335c75662ed"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"ad70e911-656d-44c8-aa82-a335c75662ed","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":841258154,"seconds":1783442197}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":52034},"address":"10.133.0.32:52034"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"ad70e911-656d-44c8-aa82-a335c75662ed","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ad70e911-656d-44c8-aa82-a335c75662ed","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ad70e911-656d-44c8-aa82-a335c75662ed","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"45032efd-f39e-4c5f-aeeb-5aab61ebf279","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52040","PortSpecifier":{"PortValue":52040}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"45032efd-f39e-4c5f-aeeb-5aab61ebf279","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"45032efd-f39e-4c5f-aeeb-5aab61ebf279","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52040","PortSpecifier":{"PortValue":52040}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442197,"nanos":853392925},"http":{"id":"45032efd-f39e-4c5f-aeeb-5aab61ebf279","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"45032efd-f39e-4c5f-aeeb-5aab61ebf279","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"45032efd-f39e-4c5f-aeeb-5aab61ebf279","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"45032efd-f39e-4c5f-aeeb-5aab61ebf279","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"45032efd-f39e-4c5f-aeeb-5aab61ebf279","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"45032efd-f39e-4c5f-aeeb-5aab61ebf279"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"45032efd-f39e-4c5f-aeeb-5aab61ebf279","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":853392925,"seconds":1783442197}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":52040},"address":"10.133.0.32:52040"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"45032efd-f39e-4c5f-aeeb-5aab61ebf279","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"45032efd-f39e-4c5f-aeeb-5aab61ebf279","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"45032efd-f39e-4c5f-aeeb-5aab61ebf279","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a39a4065-f7cd-4a97-b06e-f23919cb9b25","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52044","PortSpecifier":{"PortValue":52044}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"a39a4065-f7cd-4a97-b06e-f23919cb9b25","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a39a4065-f7cd-4a97-b06e-f23919cb9b25","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52044","PortSpecifier":{"PortValue":52044}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442197,"nanos":865353481},"http":{"id":"a39a4065-f7cd-4a97-b06e-f23919cb9b25","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"a39a4065-f7cd-4a97-b06e-f23919cb9b25","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a39a4065-f7cd-4a97-b06e-f23919cb9b25","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a39a4065-f7cd-4a97-b06e-f23919cb9b25","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"a39a4065-f7cd-4a97-b06e-f23919cb9b25","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"a39a4065-f7cd-4a97-b06e-f23919cb9b25"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"a39a4065-f7cd-4a97-b06e-f23919cb9b25","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":865353481,"seconds":1783442197}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":52044},"address":"10.133.0.32:52044"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"a39a4065-f7cd-4a97-b06e-f23919cb9b25","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a39a4065-f7cd-4a97-b06e-f23919cb9b25","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a39a4065-f7cd-4a97-b06e-f23919cb9b25","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5d643045-2202-4707-b022-fe0f56dcde79","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52050","PortSpecifier":{"PortValue":52050}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"5d643045-2202-4707-b022-fe0f56dcde79","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5d643045-2202-4707-b022-fe0f56dcde79","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52050","PortSpecifier":{"PortValue":52050}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442197,"nanos":891483202},"http":{"id":"5d643045-2202-4707-b022-fe0f56dcde79","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"5d643045-2202-4707-b022-fe0f56dcde79","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"5d643045-2202-4707-b022-fe0f56dcde79","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"5d643045-2202-4707-b022-fe0f56dcde79","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"5d643045-2202-4707-b022-fe0f56dcde79","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"5d643045-2202-4707-b022-fe0f56dcde79"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"5d643045-2202-4707-b022-fe0f56dcde79","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":891483202,"seconds":1783442197}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":52050},"address":"10.133.0.32:52050"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"5d643045-2202-4707-b022-fe0f56dcde79","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5d643045-2202-4707-b022-fe0f56dcde79","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5d643045-2202-4707-b022-fe0f56dcde79","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"57c649d3-9a5a-4118-bea1-494d7ace3050","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52062","PortSpecifier":{"PortValue":52062}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"57c649d3-9a5a-4118-bea1-494d7ace3050","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"57c649d3-9a5a-4118-bea1-494d7ace3050","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52062","PortSpecifier":{"PortValue":52062}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442197,"nanos":904581916},"http":{"id":"57c649d3-9a5a-4118-bea1-494d7ace3050","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"57c649d3-9a5a-4118-bea1-494d7ace3050","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"57c649d3-9a5a-4118-bea1-494d7ace3050","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"57c649d3-9a5a-4118-bea1-494d7ace3050","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"57c649d3-9a5a-4118-bea1-494d7ace3050","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"57c649d3-9a5a-4118-bea1-494d7ace3050"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"57c649d3-9a5a-4118-bea1-494d7ace3050","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":904581916,"seconds":1783442197}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":52062},"address":"10.133.0.32:52062"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"57c649d3-9a5a-4118-bea1-494d7ace3050","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"57c649d3-9a5a-4118-bea1-494d7ace3050","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"57c649d3-9a5a-4118-bea1-494d7ace3050","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e02adecf-cae1-465b-b36b-44795edaa4ab","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52078","PortSpecifier":{"PortValue":52078}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"e02adecf-cae1-465b-b36b-44795edaa4ab","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e02adecf-cae1-465b-b36b-44795edaa4ab","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52078","PortSpecifier":{"PortValue":52078}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442197,"nanos":916543393},"http":{"id":"e02adecf-cae1-465b-b36b-44795edaa4ab","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"e02adecf-cae1-465b-b36b-44795edaa4ab","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"e02adecf-cae1-465b-b36b-44795edaa4ab","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"e02adecf-cae1-465b-b36b-44795edaa4ab","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"e02adecf-cae1-465b-b36b-44795edaa4ab","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"e02adecf-cae1-465b-b36b-44795edaa4ab"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"e02adecf-cae1-465b-b36b-44795edaa4ab","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":916543393,"seconds":1783442197}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":52078},"address":"10.133.0.32:52078"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"e02adecf-cae1-465b-b36b-44795edaa4ab","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e02adecf-cae1-465b-b36b-44795edaa4ab","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e02adecf-cae1-465b-b36b-44795edaa4ab","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"bbe69877-249a-42ea-ada2-99477b82059d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52082","PortSpecifier":{"PortValue":52082}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"bbe69877-249a-42ea-ada2-99477b82059d","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"bbe69877-249a-42ea-ada2-99477b82059d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52082","PortSpecifier":{"PortValue":52082}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442197,"nanos":928744145},"http":{"id":"bbe69877-249a-42ea-ada2-99477b82059d","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"bbe69877-249a-42ea-ada2-99477b82059d","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"bbe69877-249a-42ea-ada2-99477b82059d","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"bbe69877-249a-42ea-ada2-99477b82059d","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"bbe69877-249a-42ea-ada2-99477b82059d","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"bbe69877-249a-42ea-ada2-99477b82059d"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"bbe69877-249a-42ea-ada2-99477b82059d","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":928744145,"seconds":1783442197}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":52082},"address":"10.133.0.32:52082"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"bbe69877-249a-42ea-ada2-99477b82059d","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"bbe69877-249a-42ea-ada2-99477b82059d","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"bbe69877-249a-42ea-ada2-99477b82059d","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"68bbecc5-a02e-4969-bcad-ced7644043ff","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52090","PortSpecifier":{"PortValue":52090}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"68bbecc5-a02e-4969-bcad-ced7644043ff","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"68bbecc5-a02e-4969-bcad-ced7644043ff","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52090","PortSpecifier":{"PortValue":52090}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442197,"nanos":940928934},"http":{"id":"68bbecc5-a02e-4969-bcad-ced7644043ff","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"68bbecc5-a02e-4969-bcad-ced7644043ff","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"68bbecc5-a02e-4969-bcad-ced7644043ff","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"68bbecc5-a02e-4969-bcad-ced7644043ff","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"68bbecc5-a02e-4969-bcad-ced7644043ff","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"68bbecc5-a02e-4969-bcad-ced7644043ff"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"68bbecc5-a02e-4969-bcad-ced7644043ff","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":940928934,"seconds":1783442197}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":52090},"address":"10.133.0.32:52090"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"68bbecc5-a02e-4969-bcad-ced7644043ff","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"68bbecc5-a02e-4969-bcad-ced7644043ff","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"68bbecc5-a02e-4969-bcad-ced7644043ff","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"4c84732f-f3b2-439a-bade-a121cbefaed7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52102","PortSpecifier":{"PortValue":52102}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"4c84732f-f3b2-439a-bade-a121cbefaed7","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"4c84732f-f3b2-439a-bade-a121cbefaed7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52102","PortSpecifier":{"PortValue":52102}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442197,"nanos":953664318},"http":{"id":"4c84732f-f3b2-439a-bade-a121cbefaed7","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"4c84732f-f3b2-439a-bade-a121cbefaed7","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"4c84732f-f3b2-439a-bade-a121cbefaed7","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"4c84732f-f3b2-439a-bade-a121cbefaed7","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"4c84732f-f3b2-439a-bade-a121cbefaed7","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"4c84732f-f3b2-439a-bade-a121cbefaed7"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"4c84732f-f3b2-439a-bade-a121cbefaed7","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":953664318,"seconds":1783442197}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":52102},"address":"10.133.0.32:52102"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"4c84732f-f3b2-439a-bade-a121cbefaed7","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4c84732f-f3b2-439a-bade-a121cbefaed7","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4c84732f-f3b2-439a-bade-a121cbefaed7","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"33498652-5e4d-4b9e-b141-c7502f124fa0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52112","PortSpecifier":{"PortValue":52112}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"33498652-5e4d-4b9e-b141-c7502f124fa0","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"33498652-5e4d-4b9e-b141-c7502f124fa0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52112","PortSpecifier":{"PortValue":52112}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442197,"nanos":998975467},"http":{"id":"33498652-5e4d-4b9e-b141-c7502f124fa0","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"33498652-5e4d-4b9e-b141-c7502f124fa0","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"33498652-5e4d-4b9e-b141-c7502f124fa0","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"33498652-5e4d-4b9e-b141-c7502f124fa0","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"33498652-5e4d-4b9e-b141-c7502f124fa0","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"33498652-5e4d-4b9e-b141-c7502f124fa0"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"33498652-5e4d-4b9e-b141-c7502f124fa0","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":998975467,"seconds":1783442197}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":52112},"address":"10.133.0.32:52112"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"33498652-5e4d-4b9e-b141-c7502f124fa0","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"33498652-5e4d-4b9e-b141-c7502f124fa0","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"33498652-5e4d-4b9e-b141-c7502f124fa0","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"43f837ad-a454-48ed-bfff-14b298f575ba","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52122","PortSpecifier":{"PortValue":52122}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"43f837ad-a454-48ed-bfff-14b298f575ba","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"43f837ad-a454-48ed-bfff-14b298f575ba","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52122","PortSpecifier":{"PortValue":52122}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442198,"nanos":11746806},"http":{"id":"43f837ad-a454-48ed-bfff-14b298f575ba","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"43f837ad-a454-48ed-bfff-14b298f575ba","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"43f837ad-a454-48ed-bfff-14b298f575ba","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"43f837ad-a454-48ed-bfff-14b298f575ba","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"43f837ad-a454-48ed-bfff-14b298f575ba","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"43f837ad-a454-48ed-bfff-14b298f575ba"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"43f837ad-a454-48ed-bfff-14b298f575ba","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":11746806,"seconds":1783442198}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":52122},"address":"10.133.0.32:52122"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"43f837ad-a454-48ed-bfff-14b298f575ba","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"43f837ad-a454-48ed-bfff-14b298f575ba","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"43f837ad-a454-48ed-bfff-14b298f575ba","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"172f31e0-91ef-43f1-bd72-23621d6eabb8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52132","PortSpecifier":{"PortValue":52132}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"172f31e0-91ef-43f1-bd72-23621d6eabb8","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"172f31e0-91ef-43f1-bd72-23621d6eabb8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52132","PortSpecifier":{"PortValue":52132}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442198,"nanos":24356544},"http":{"id":"172f31e0-91ef-43f1-bd72-23621d6eabb8","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"172f31e0-91ef-43f1-bd72-23621d6eabb8","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"172f31e0-91ef-43f1-bd72-23621d6eabb8","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"172f31e0-91ef-43f1-bd72-23621d6eabb8","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"172f31e0-91ef-43f1-bd72-23621d6eabb8","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"172f31e0-91ef-43f1-bd72-23621d6eabb8"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"172f31e0-91ef-43f1-bd72-23621d6eabb8","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":24356544,"seconds":1783442198}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":52132},"address":"10.133.0.32:52132"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"172f31e0-91ef-43f1-bd72-23621d6eabb8","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"172f31e0-91ef-43f1-bd72-23621d6eabb8","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"172f31e0-91ef-43f1-bd72-23621d6eabb8","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"172f31e0-91ef-43f1-bd72-23621d6eabb8","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"172f31e0-91ef-43f1-bd72-23621d6eabb8","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:maas-admin:tester-admin-user"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"172f31e0-91ef-43f1-bd72-23621d6eabb8","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"172f31e0-91ef-43f1-bd72-23621d6eabb8","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:maas-admin\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"172f31e0-91ef-43f1-bd72-23621d6eabb8","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"172f31e0-91ef-43f1-bd72-23621d6eabb8","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6c902f47-575c-4136-a3a2-fa749c3a2c14","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52134","PortSpecifier":{"PortValue":52134}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"6c902f47-575c-4136-a3a2-fa749c3a2c14","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6c902f47-575c-4136-a3a2-fa749c3a2c14","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52134","PortSpecifier":{"PortValue":52134}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442198,"nanos":36872982},"http":{"id":"6c902f47-575c-4136-a3a2-fa749c3a2c14","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"6c902f47-575c-4136-a3a2-fa749c3a2c14","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"6c902f47-575c-4136-a3a2-fa749c3a2c14","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"6c902f47-575c-4136-a3a2-fa749c3a2c14","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"6c902f47-575c-4136-a3a2-fa749c3a2c14","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"6c902f47-575c-4136-a3a2-fa749c3a2c14"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"6c902f47-575c-4136-a3a2-fa749c3a2c14","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":36872982,"seconds":1783442198}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":52134},"address":"10.133.0.32:52134"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6c902f47-575c-4136-a3a2-fa749c3a2c14","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6c902f47-575c-4136-a3a2-fa749c3a2c14","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6c902f47-575c-4136-a3a2-fa749c3a2c14","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6c902f47-575c-4136-a3a2-fa749c3a2c14","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:maas-admin:tester-admin-user"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"6c902f47-575c-4136-a3a2-fa749c3a2c14","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6c902f47-575c-4136-a3a2-fa749c3a2c14","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:maas-admin\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6c902f47-575c-4136-a3a2-fa749c3a2c14","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6c902f47-575c-4136-a3a2-fa749c3a2c14","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6c902f47-575c-4136-a3a2-fa749c3a2c14","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"93293636-ca77-46bd-9da5-e3e590fc98f3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52140","PortSpecifier":{"PortValue":52140}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"93293636-ca77-46bd-9da5-e3e590fc98f3","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"93293636-ca77-46bd-9da5-e3e590fc98f3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52140","PortSpecifier":{"PortValue":52140}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442198,"nanos":49305902},"http":{"id":"93293636-ca77-46bd-9da5-e3e590fc98f3","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"93293636-ca77-46bd-9da5-e3e590fc98f3","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"93293636-ca77-46bd-9da5-e3e590fc98f3","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"93293636-ca77-46bd-9da5-e3e590fc98f3","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"93293636-ca77-46bd-9da5-e3e590fc98f3","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"93293636-ca77-46bd-9da5-e3e590fc98f3"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"93293636-ca77-46bd-9da5-e3e590fc98f3","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":49305902,"seconds":1783442198}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":52140},"address":"10.133.0.32:52140"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"93293636-ca77-46bd-9da5-e3e590fc98f3","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"93293636-ca77-46bd-9da5-e3e590fc98f3","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"93293636-ca77-46bd-9da5-e3e590fc98f3","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"93293636-ca77-46bd-9da5-e3e590fc98f3","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:maas-admin:tester-admin-user"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"93293636-ca77-46bd-9da5-e3e590fc98f3","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"93293636-ca77-46bd-9da5-e3e590fc98f3","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"93293636-ca77-46bd-9da5-e3e590fc98f3","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:maas-admin\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"93293636-ca77-46bd-9da5-e3e590fc98f3","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"93293636-ca77-46bd-9da5-e3e590fc98f3","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5f372580-27ac-439d-bce4-582914a846b7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52146","PortSpecifier":{"PortValue":52146}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"5f372580-27ac-439d-bce4-582914a846b7","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5f372580-27ac-439d-bce4-582914a846b7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52146","PortSpecifier":{"PortValue":52146}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442198,"nanos":61648589},"http":{"id":"5f372580-27ac-439d-bce4-582914a846b7","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"5f372580-27ac-439d-bce4-582914a846b7","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"5f372580-27ac-439d-bce4-582914a846b7","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"5f372580-27ac-439d-bce4-582914a846b7","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"5f372580-27ac-439d-bce4-582914a846b7","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"5f372580-27ac-439d-bce4-582914a846b7"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"5f372580-27ac-439d-bce4-582914a846b7","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":61648589,"seconds":1783442198}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":52146},"address":"10.133.0.32:52146"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5f372580-27ac-439d-bce4-582914a846b7","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5f372580-27ac-439d-bce4-582914a846b7","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5f372580-27ac-439d-bce4-582914a846b7","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5f372580-27ac-439d-bce4-582914a846b7","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:maas-admin:tester-admin-user"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"5f372580-27ac-439d-bce4-582914a846b7","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5f372580-27ac-439d-bce4-582914a846b7","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5f372580-27ac-439d-bce4-582914a846b7","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:maas-admin\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5f372580-27ac-439d-bce4-582914a846b7","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5f372580-27ac-439d-bce4-582914a846b7","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"90fae4c2-bfd3-41d0-a5d9-85741a823de0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52158","PortSpecifier":{"PortValue":52158}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"90fae4c2-bfd3-41d0-a5d9-85741a823de0","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"90fae4c2-bfd3-41d0-a5d9-85741a823de0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52158","PortSpecifier":{"PortValue":52158}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442198,"nanos":98426989},"http":{"id":"90fae4c2-bfd3-41d0-a5d9-85741a823de0","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"90fae4c2-bfd3-41d0-a5d9-85741a823de0","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"90fae4c2-bfd3-41d0-a5d9-85741a823de0","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"90fae4c2-bfd3-41d0-a5d9-85741a823de0","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"90fae4c2-bfd3-41d0-a5d9-85741a823de0","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"90fae4c2-bfd3-41d0-a5d9-85741a823de0"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"90fae4c2-bfd3-41d0-a5d9-85741a823de0","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":98426989,"seconds":1783442198}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":52158},"address":"10.133.0.32:52158"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"90fae4c2-bfd3-41d0-a5d9-85741a823de0","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"90fae4c2-bfd3-41d0-a5d9-85741a823de0","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"90fae4c2-bfd3-41d0-a5d9-85741a823de0","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"90fae4c2-bfd3-41d0-a5d9-85741a823de0","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"90fae4c2-bfd3-41d0-a5d9-85741a823de0","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:maas-admin:tester-admin-user"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"90fae4c2-bfd3-41d0-a5d9-85741a823de0","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:maas-admin\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"90fae4c2-bfd3-41d0-a5d9-85741a823de0","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"90fae4c2-bfd3-41d0-a5d9-85741a823de0","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"90fae4c2-bfd3-41d0-a5d9-85741a823de0","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"20328cd3-ee61-4f47-a556-146ef5462dd5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52174","PortSpecifier":{"PortValue":52174}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"20328cd3-ee61-4f47-a556-146ef5462dd5","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"20328cd3-ee61-4f47-a556-146ef5462dd5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52174","PortSpecifier":{"PortValue":52174}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442198,"nanos":111145748},"http":{"id":"20328cd3-ee61-4f47-a556-146ef5462dd5","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"20328cd3-ee61-4f47-a556-146ef5462dd5","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"20328cd3-ee61-4f47-a556-146ef5462dd5","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"20328cd3-ee61-4f47-a556-146ef5462dd5","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"20328cd3-ee61-4f47-a556-146ef5462dd5","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"20328cd3-ee61-4f47-a556-146ef5462dd5"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"20328cd3-ee61-4f47-a556-146ef5462dd5","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":111145748,"seconds":1783442198}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":52174},"address":"10.133.0.32:52174"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"20328cd3-ee61-4f47-a556-146ef5462dd5","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"20328cd3-ee61-4f47-a556-146ef5462dd5","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"20328cd3-ee61-4f47-a556-146ef5462dd5","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"20328cd3-ee61-4f47-a556-146ef5462dd5","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"20328cd3-ee61-4f47-a556-146ef5462dd5","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:maas-admin:tester-admin-user"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"20328cd3-ee61-4f47-a556-146ef5462dd5","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"20328cd3-ee61-4f47-a556-146ef5462dd5","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:maas-admin\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"20328cd3-ee61-4f47-a556-146ef5462dd5","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"20328cd3-ee61-4f47-a556-146ef5462dd5","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"304bc4ec-b6b6-42c6-b431-424ee89d9171","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52186","PortSpecifier":{"PortValue":52186}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"304bc4ec-b6b6-42c6-b431-424ee89d9171","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"304bc4ec-b6b6-42c6-b431-424ee89d9171","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52186","PortSpecifier":{"PortValue":52186}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442198,"nanos":123973524},"http":{"id":"304bc4ec-b6b6-42c6-b431-424ee89d9171","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"304bc4ec-b6b6-42c6-b431-424ee89d9171","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"304bc4ec-b6b6-42c6-b431-424ee89d9171","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"304bc4ec-b6b6-42c6-b431-424ee89d9171","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"304bc4ec-b6b6-42c6-b431-424ee89d9171","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"304bc4ec-b6b6-42c6-b431-424ee89d9171"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"304bc4ec-b6b6-42c6-b431-424ee89d9171","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":123973524,"seconds":1783442198}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":52186},"address":"10.133.0.32:52186"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"304bc4ec-b6b6-42c6-b431-424ee89d9171","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"304bc4ec-b6b6-42c6-b431-424ee89d9171","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"304bc4ec-b6b6-42c6-b431-424ee89d9171","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"304bc4ec-b6b6-42c6-b431-424ee89d9171","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"304bc4ec-b6b6-42c6-b431-424ee89d9171","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:maas-admin:tester-admin-user"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"304bc4ec-b6b6-42c6-b431-424ee89d9171","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"304bc4ec-b6b6-42c6-b431-424ee89d9171","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:maas-admin\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"304bc4ec-b6b6-42c6-b431-424ee89d9171","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"304bc4ec-b6b6-42c6-b431-424ee89d9171","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"74fe707a-adeb-4ada-9c52-931e75f7286e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52194","PortSpecifier":{"PortValue":52194}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"74fe707a-adeb-4ada-9c52-931e75f7286e","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"74fe707a-adeb-4ada-9c52-931e75f7286e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52194","PortSpecifier":{"PortValue":52194}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442198,"nanos":136232740},"http":{"id":"74fe707a-adeb-4ada-9c52-931e75f7286e","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"74fe707a-adeb-4ada-9c52-931e75f7286e","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"74fe707a-adeb-4ada-9c52-931e75f7286e","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"74fe707a-adeb-4ada-9c52-931e75f7286e","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"74fe707a-adeb-4ada-9c52-931e75f7286e","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"74fe707a-adeb-4ada-9c52-931e75f7286e"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"74fe707a-adeb-4ada-9c52-931e75f7286e","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":136232740,"seconds":1783442198}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":52194},"address":"10.133.0.32:52194"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"74fe707a-adeb-4ada-9c52-931e75f7286e","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"74fe707a-adeb-4ada-9c52-931e75f7286e","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"74fe707a-adeb-4ada-9c52-931e75f7286e","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"74fe707a-adeb-4ada-9c52-931e75f7286e","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"74fe707a-adeb-4ada-9c52-931e75f7286e","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:maas-admin:tester-admin-user"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"74fe707a-adeb-4ada-9c52-931e75f7286e","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:maas-admin\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"74fe707a-adeb-4ada-9c52-931e75f7286e","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"74fe707a-adeb-4ada-9c52-931e75f7286e","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"74fe707a-adeb-4ada-9c52-931e75f7286e","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3f278300-65a7-411a-82f9-6520732d65b3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52202","PortSpecifier":{"PortValue":52202}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"3f278300-65a7-411a-82f9-6520732d65b3","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3f278300-65a7-411a-82f9-6520732d65b3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52202","PortSpecifier":{"PortValue":52202}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442198,"nanos":148320486},"http":{"id":"3f278300-65a7-411a-82f9-6520732d65b3","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"3f278300-65a7-411a-82f9-6520732d65b3","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"3f278300-65a7-411a-82f9-6520732d65b3","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"3f278300-65a7-411a-82f9-6520732d65b3","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"3f278300-65a7-411a-82f9-6520732d65b3","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"3f278300-65a7-411a-82f9-6520732d65b3"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"3f278300-65a7-411a-82f9-6520732d65b3","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":148320486,"seconds":1783442198}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":52202},"address":"10.133.0.32:52202"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3f278300-65a7-411a-82f9-6520732d65b3","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3f278300-65a7-411a-82f9-6520732d65b3","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3f278300-65a7-411a-82f9-6520732d65b3","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"3f278300-65a7-411a-82f9-6520732d65b3","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3f278300-65a7-411a-82f9-6520732d65b3","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3f278300-65a7-411a-82f9-6520732d65b3","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:maas-admin:tester-admin-user"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3f278300-65a7-411a-82f9-6520732d65b3","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:maas-admin\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3f278300-65a7-411a-82f9-6520732d65b3","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3f278300-65a7-411a-82f9-6520732d65b3","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"fff1882e-22a5-4f36-995a-db5bd77b4c52","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52208","PortSpecifier":{"PortValue":52208}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"fff1882e-22a5-4f36-995a-db5bd77b4c52","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"fff1882e-22a5-4f36-995a-db5bd77b4c52","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52208","PortSpecifier":{"PortValue":52208}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442198,"nanos":160363114},"http":{"id":"fff1882e-22a5-4f36-995a-db5bd77b4c52","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"fff1882e-22a5-4f36-995a-db5bd77b4c52","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"fff1882e-22a5-4f36-995a-db5bd77b4c52","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"fff1882e-22a5-4f36-995a-db5bd77b4c52","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"fff1882e-22a5-4f36-995a-db5bd77b4c52","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"fff1882e-22a5-4f36-995a-db5bd77b4c52"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"fff1882e-22a5-4f36-995a-db5bd77b4c52","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":160363114,"seconds":1783442198}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":52208},"address":"10.133.0.32:52208"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fff1882e-22a5-4f36-995a-db5bd77b4c52","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fff1882e-22a5-4f36-995a-db5bd77b4c52","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fff1882e-22a5-4f36-995a-db5bd77b4c52","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"fff1882e-22a5-4f36-995a-db5bd77b4c52","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"fff1882e-22a5-4f36-995a-db5bd77b4c52","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:maas-admin\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"fff1882e-22a5-4f36-995a-db5bd77b4c52","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:maas-admin:tester-admin-user"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"fff1882e-22a5-4f36-995a-db5bd77b4c52","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"fff1882e-22a5-4f36-995a-db5bd77b4c52","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"fff1882e-22a5-4f36-995a-db5bd77b4c52","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"eeb41dea-e389-451b-9ce9-cc9aec508605","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52218","PortSpecifier":{"PortValue":52218}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"eeb41dea-e389-451b-9ce9-cc9aec508605","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"eeb41dea-e389-451b-9ce9-cc9aec508605","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52218","PortSpecifier":{"PortValue":52218}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442198,"nanos":190967482},"http":{"id":"eeb41dea-e389-451b-9ce9-cc9aec508605","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"eeb41dea-e389-451b-9ce9-cc9aec508605","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"eeb41dea-e389-451b-9ce9-cc9aec508605","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"eeb41dea-e389-451b-9ce9-cc9aec508605","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"eeb41dea-e389-451b-9ce9-cc9aec508605","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"eeb41dea-e389-451b-9ce9-cc9aec508605"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"eeb41dea-e389-451b-9ce9-cc9aec508605","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":190967482,"seconds":1783442198}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":52218},"address":"10.133.0.32:52218"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"eeb41dea-e389-451b-9ce9-cc9aec508605","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"eeb41dea-e389-451b-9ce9-cc9aec508605","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"eeb41dea-e389-451b-9ce9-cc9aec508605","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"eeb41dea-e389-451b-9ce9-cc9aec508605","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"eeb41dea-e389-451b-9ce9-cc9aec508605","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:maas-admin:tester-admin-user"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"eeb41dea-e389-451b-9ce9-cc9aec508605","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:maas-admin\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"eeb41dea-e389-451b-9ce9-cc9aec508605","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"eeb41dea-e389-451b-9ce9-cc9aec508605","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"eeb41dea-e389-451b-9ce9-cc9aec508605","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b72bd8c0-1045-4414-a969-d6c8e255c5cb","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52222","PortSpecifier":{"PortValue":52222}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"b72bd8c0-1045-4414-a969-d6c8e255c5cb","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b72bd8c0-1045-4414-a969-d6c8e255c5cb","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52222","PortSpecifier":{"PortValue":52222}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442198,"nanos":204116288},"http":{"id":"b72bd8c0-1045-4414-a969-d6c8e255c5cb","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"b72bd8c0-1045-4414-a969-d6c8e255c5cb","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"b72bd8c0-1045-4414-a969-d6c8e255c5cb","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"b72bd8c0-1045-4414-a969-d6c8e255c5cb","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"b72bd8c0-1045-4414-a969-d6c8e255c5cb","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"b72bd8c0-1045-4414-a969-d6c8e255c5cb"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"b72bd8c0-1045-4414-a969-d6c8e255c5cb","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":204116288,"seconds":1783442198}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":52222},"address":"10.133.0.32:52222"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b72bd8c0-1045-4414-a969-d6c8e255c5cb","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b72bd8c0-1045-4414-a969-d6c8e255c5cb","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b72bd8c0-1045-4414-a969-d6c8e255c5cb","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b72bd8c0-1045-4414-a969-d6c8e255c5cb","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:maas-admin:tester-admin-user"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"b72bd8c0-1045-4414-a969-d6c8e255c5cb","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b72bd8c0-1045-4414-a969-d6c8e255c5cb","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b72bd8c0-1045-4414-a969-d6c8e255c5cb","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:maas-admin\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b72bd8c0-1045-4414-a969-d6c8e255c5cb","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b72bd8c0-1045-4414-a969-d6c8e255c5cb","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5e18e9eb-8b0f-4dc1-b55c-3426de3c8f4d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52232","PortSpecifier":{"PortValue":52232}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"5e18e9eb-8b0f-4dc1-b55c-3426de3c8f4d","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5e18e9eb-8b0f-4dc1-b55c-3426de3c8f4d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52232","PortSpecifier":{"PortValue":52232}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442198,"nanos":216752182},"http":{"id":"5e18e9eb-8b0f-4dc1-b55c-3426de3c8f4d","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"5e18e9eb-8b0f-4dc1-b55c-3426de3c8f4d","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"5e18e9eb-8b0f-4dc1-b55c-3426de3c8f4d","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"5e18e9eb-8b0f-4dc1-b55c-3426de3c8f4d","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"5e18e9eb-8b0f-4dc1-b55c-3426de3c8f4d","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"5e18e9eb-8b0f-4dc1-b55c-3426de3c8f4d"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"5e18e9eb-8b0f-4dc1-b55c-3426de3c8f4d","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":216752182,"seconds":1783442198}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":52232},"address":"10.133.0.32:52232"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5e18e9eb-8b0f-4dc1-b55c-3426de3c8f4d","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5e18e9eb-8b0f-4dc1-b55c-3426de3c8f4d","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5e18e9eb-8b0f-4dc1-b55c-3426de3c8f4d","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"5e18e9eb-8b0f-4dc1-b55c-3426de3c8f4d","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5e18e9eb-8b0f-4dc1-b55c-3426de3c8f4d","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:maas-admin:tester-admin-user"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5e18e9eb-8b0f-4dc1-b55c-3426de3c8f4d","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:maas-admin\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5e18e9eb-8b0f-4dc1-b55c-3426de3c8f4d","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5e18e9eb-8b0f-4dc1-b55c-3426de3c8f4d","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5e18e9eb-8b0f-4dc1-b55c-3426de3c8f4d","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f526e62a-26dc-4423-a163-2625d041cf1a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52242","PortSpecifier":{"PortValue":52242}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"f526e62a-26dc-4423-a163-2625d041cf1a","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f526e62a-26dc-4423-a163-2625d041cf1a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52242","PortSpecifier":{"PortValue":52242}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442198,"nanos":229173079},"http":{"id":"f526e62a-26dc-4423-a163-2625d041cf1a","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"f526e62a-26dc-4423-a163-2625d041cf1a","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"f526e62a-26dc-4423-a163-2625d041cf1a","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"f526e62a-26dc-4423-a163-2625d041cf1a","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"f526e62a-26dc-4423-a163-2625d041cf1a","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"f526e62a-26dc-4423-a163-2625d041cf1a"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"f526e62a-26dc-4423-a163-2625d041cf1a","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":229173079,"seconds":1783442198}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":52242},"address":"10.133.0.32:52242"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f526e62a-26dc-4423-a163-2625d041cf1a","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f526e62a-26dc-4423-a163-2625d041cf1a","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f526e62a-26dc-4423-a163-2625d041cf1a","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"f526e62a-26dc-4423-a163-2625d041cf1a","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f526e62a-26dc-4423-a163-2625d041cf1a","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:maas-admin:tester-admin-user"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f526e62a-26dc-4423-a163-2625d041cf1a","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f526e62a-26dc-4423-a163-2625d041cf1a","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:maas-admin\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f526e62a-26dc-4423-a163-2625d041cf1a","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f526e62a-26dc-4423-a163-2625d041cf1a","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8d1013ae-cfb3-4deb-9393-f45e94fffa32","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52248","PortSpecifier":{"PortValue":52248}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"8d1013ae-cfb3-4deb-9393-f45e94fffa32","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8d1013ae-cfb3-4deb-9393-f45e94fffa32","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52248","PortSpecifier":{"PortValue":52248}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442198,"nanos":242420869},"http":{"id":"8d1013ae-cfb3-4deb-9393-f45e94fffa32","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"8d1013ae-cfb3-4deb-9393-f45e94fffa32","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"8d1013ae-cfb3-4deb-9393-f45e94fffa32","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"8d1013ae-cfb3-4deb-9393-f45e94fffa32","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"8d1013ae-cfb3-4deb-9393-f45e94fffa32","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"8d1013ae-cfb3-4deb-9393-f45e94fffa32"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"8d1013ae-cfb3-4deb-9393-f45e94fffa32","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":242420869,"seconds":1783442198}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":52248},"address":"10.133.0.32:52248"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8d1013ae-cfb3-4deb-9393-f45e94fffa32","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8d1013ae-cfb3-4deb-9393-f45e94fffa32","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8d1013ae-cfb3-4deb-9393-f45e94fffa32","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"8d1013ae-cfb3-4deb-9393-f45e94fffa32","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8d1013ae-cfb3-4deb-9393-f45e94fffa32","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:maas-admin:tester-admin-user"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8d1013ae-cfb3-4deb-9393-f45e94fffa32","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8d1013ae-cfb3-4deb-9393-f45e94fffa32","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:maas-admin\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8d1013ae-cfb3-4deb-9393-f45e94fffa32","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8d1013ae-cfb3-4deb-9393-f45e94fffa32","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6e15222c-373e-4d5b-bae5-0a6d63ec2867","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52250","PortSpecifier":{"PortValue":52250}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"6e15222c-373e-4d5b-bae5-0a6d63ec2867","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6e15222c-373e-4d5b-bae5-0a6d63ec2867","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52250","PortSpecifier":{"PortValue":52250}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442198,"nanos":255246636},"http":{"id":"6e15222c-373e-4d5b-bae5-0a6d63ec2867","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"6e15222c-373e-4d5b-bae5-0a6d63ec2867","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"6e15222c-373e-4d5b-bae5-0a6d63ec2867","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"6e15222c-373e-4d5b-bae5-0a6d63ec2867","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"6e15222c-373e-4d5b-bae5-0a6d63ec2867","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"6e15222c-373e-4d5b-bae5-0a6d63ec2867"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"6e15222c-373e-4d5b-bae5-0a6d63ec2867","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":255246636,"seconds":1783442198}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":52250},"address":"10.133.0.32:52250"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6e15222c-373e-4d5b-bae5-0a6d63ec2867","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6e15222c-373e-4d5b-bae5-0a6d63ec2867","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6e15222c-373e-4d5b-bae5-0a6d63ec2867","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"6e15222c-373e-4d5b-bae5-0a6d63ec2867","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6e15222c-373e-4d5b-bae5-0a6d63ec2867","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:maas-admin:tester-admin-user"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6e15222c-373e-4d5b-bae5-0a6d63ec2867","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:maas-admin\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6e15222c-373e-4d5b-bae5-0a6d63ec2867","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6e15222c-373e-4d5b-bae5-0a6d63ec2867","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6e15222c-373e-4d5b-bae5-0a6d63ec2867","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7f16ef08-445f-4b46-ad3c-919a39d22df8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52260","PortSpecifier":{"PortValue":52260}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"7f16ef08-445f-4b46-ad3c-919a39d22df8","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7f16ef08-445f-4b46-ad3c-919a39d22df8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52260","PortSpecifier":{"PortValue":52260}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442198,"nanos":290879728},"http":{"id":"7f16ef08-445f-4b46-ad3c-919a39d22df8","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"7f16ef08-445f-4b46-ad3c-919a39d22df8","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"7f16ef08-445f-4b46-ad3c-919a39d22df8","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"7f16ef08-445f-4b46-ad3c-919a39d22df8","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"7f16ef08-445f-4b46-ad3c-919a39d22df8","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"7f16ef08-445f-4b46-ad3c-919a39d22df8"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"7f16ef08-445f-4b46-ad3c-919a39d22df8","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":290879728,"seconds":1783442198}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":52260},"address":"10.133.0.32:52260"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7f16ef08-445f-4b46-ad3c-919a39d22df8","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7f16ef08-445f-4b46-ad3c-919a39d22df8","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7f16ef08-445f-4b46-ad3c-919a39d22df8","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"7f16ef08-445f-4b46-ad3c-919a39d22df8","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7f16ef08-445f-4b46-ad3c-919a39d22df8","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7f16ef08-445f-4b46-ad3c-919a39d22df8","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:maas-admin:tester-admin-user"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7f16ef08-445f-4b46-ad3c-919a39d22df8","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:maas-admin\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7f16ef08-445f-4b46-ad3c-919a39d22df8","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7f16ef08-445f-4b46-ad3c-919a39d22df8","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6e28c735-fe0e-4a5c-9905-d5b9efac16fd","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52266","PortSpecifier":{"PortValue":52266}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"6e28c735-fe0e-4a5c-9905-d5b9efac16fd","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6e28c735-fe0e-4a5c-9905-d5b9efac16fd","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52266","PortSpecifier":{"PortValue":52266}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442198,"nanos":303619014},"http":{"id":"6e28c735-fe0e-4a5c-9905-d5b9efac16fd","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"6e28c735-fe0e-4a5c-9905-d5b9efac16fd","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"6e28c735-fe0e-4a5c-9905-d5b9efac16fd","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"6e28c735-fe0e-4a5c-9905-d5b9efac16fd","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"6e28c735-fe0e-4a5c-9905-d5b9efac16fd","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"6e28c735-fe0e-4a5c-9905-d5b9efac16fd"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"6e28c735-fe0e-4a5c-9905-d5b9efac16fd","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":303619014,"seconds":1783442198}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":52266},"address":"10.133.0.32:52266"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6e28c735-fe0e-4a5c-9905-d5b9efac16fd","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6e28c735-fe0e-4a5c-9905-d5b9efac16fd","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6e28c735-fe0e-4a5c-9905-d5b9efac16fd","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"6e28c735-fe0e-4a5c-9905-d5b9efac16fd","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6e28c735-fe0e-4a5c-9905-d5b9efac16fd","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6e28c735-fe0e-4a5c-9905-d5b9efac16fd","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:maas-admin:tester-admin-user"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6e28c735-fe0e-4a5c-9905-d5b9efac16fd","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:maas-admin\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6e28c735-fe0e-4a5c-9905-d5b9efac16fd","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6e28c735-fe0e-4a5c-9905-d5b9efac16fd","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1fb132d3-275d-436e-acea-0087cf1c9e05","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52280","PortSpecifier":{"PortValue":52280}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"1fb132d3-275d-436e-acea-0087cf1c9e05","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1fb132d3-275d-436e-acea-0087cf1c9e05","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52280","PortSpecifier":{"PortValue":52280}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442198,"nanos":315999153},"http":{"id":"1fb132d3-275d-436e-acea-0087cf1c9e05","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"1fb132d3-275d-436e-acea-0087cf1c9e05","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"1fb132d3-275d-436e-acea-0087cf1c9e05","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"1fb132d3-275d-436e-acea-0087cf1c9e05","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"1fb132d3-275d-436e-acea-0087cf1c9e05","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"1fb132d3-275d-436e-acea-0087cf1c9e05"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"1fb132d3-275d-436e-acea-0087cf1c9e05","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":315999153,"seconds":1783442198}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":52280},"address":"10.133.0.32:52280"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1fb132d3-275d-436e-acea-0087cf1c9e05","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1fb132d3-275d-436e-acea-0087cf1c9e05","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1fb132d3-275d-436e-acea-0087cf1c9e05","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"1fb132d3-275d-436e-acea-0087cf1c9e05","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1fb132d3-275d-436e-acea-0087cf1c9e05","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:maas-admin:tester-admin-user"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1fb132d3-275d-436e-acea-0087cf1c9e05","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1fb132d3-275d-436e-acea-0087cf1c9e05","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:maas-admin\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1fb132d3-275d-436e-acea-0087cf1c9e05","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1fb132d3-275d-436e-acea-0087cf1c9e05","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"4e8a3f72-f8a0-4e59-bab4-f0d7bc867f72","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52290","PortSpecifier":{"PortValue":52290}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"4e8a3f72-f8a0-4e59-bab4-f0d7bc867f72","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"4e8a3f72-f8a0-4e59-bab4-f0d7bc867f72","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52290","PortSpecifier":{"PortValue":52290}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442198,"nanos":328162763},"http":{"id":"4e8a3f72-f8a0-4e59-bab4-f0d7bc867f72","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"4e8a3f72-f8a0-4e59-bab4-f0d7bc867f72","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"4e8a3f72-f8a0-4e59-bab4-f0d7bc867f72","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"4e8a3f72-f8a0-4e59-bab4-f0d7bc867f72","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"4e8a3f72-f8a0-4e59-bab4-f0d7bc867f72","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"4e8a3f72-f8a0-4e59-bab4-f0d7bc867f72"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"4e8a3f72-f8a0-4e59-bab4-f0d7bc867f72","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":328162763,"seconds":1783442198}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":52290},"address":"10.133.0.32:52290"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4e8a3f72-f8a0-4e59-bab4-f0d7bc867f72","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4e8a3f72-f8a0-4e59-bab4-f0d7bc867f72","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4e8a3f72-f8a0-4e59-bab4-f0d7bc867f72","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4e8a3f72-f8a0-4e59-bab4-f0d7bc867f72","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:maas-admin:tester-admin-user"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"4e8a3f72-f8a0-4e59-bab4-f0d7bc867f72","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4e8a3f72-f8a0-4e59-bab4-f0d7bc867f72","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:maas-admin\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4e8a3f72-f8a0-4e59-bab4-f0d7bc867f72","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4e8a3f72-f8a0-4e59-bab4-f0d7bc867f72","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4e8a3f72-f8a0-4e59-bab4-f0d7bc867f72","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"23043059-f278-47b9-8f2a-b3f1a5da5508","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52304","PortSpecifier":{"PortValue":52304}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"23043059-f278-47b9-8f2a-b3f1a5da5508","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"23043059-f278-47b9-8f2a-b3f1a5da5508","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52304","PortSpecifier":{"PortValue":52304}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442198,"nanos":340729861},"http":{"id":"23043059-f278-47b9-8f2a-b3f1a5da5508","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"23043059-f278-47b9-8f2a-b3f1a5da5508","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"23043059-f278-47b9-8f2a-b3f1a5da5508","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"23043059-f278-47b9-8f2a-b3f1a5da5508","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"23043059-f278-47b9-8f2a-b3f1a5da5508","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"23043059-f278-47b9-8f2a-b3f1a5da5508"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"23043059-f278-47b9-8f2a-b3f1a5da5508","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":340729861,"seconds":1783442198}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":52304},"address":"10.133.0.32:52304"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"23043059-f278-47b9-8f2a-b3f1a5da5508","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"23043059-f278-47b9-8f2a-b3f1a5da5508","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"23043059-f278-47b9-8f2a-b3f1a5da5508","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"23043059-f278-47b9-8f2a-b3f1a5da5508","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:maas-admin:tester-admin-user"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"23043059-f278-47b9-8f2a-b3f1a5da5508","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"23043059-f278-47b9-8f2a-b3f1a5da5508","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:maas-admin\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"23043059-f278-47b9-8f2a-b3f1a5da5508","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"23043059-f278-47b9-8f2a-b3f1a5da5508","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"23043059-f278-47b9-8f2a-b3f1a5da5508","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e2e5ac4d-579a-4daa-9daf-a042a69acac7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52320","PortSpecifier":{"PortValue":52320}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"e2e5ac4d-579a-4daa-9daf-a042a69acac7","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e2e5ac4d-579a-4daa-9daf-a042a69acac7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52320","PortSpecifier":{"PortValue":52320}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442198,"nanos":352871013},"http":{"id":"e2e5ac4d-579a-4daa-9daf-a042a69acac7","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"e2e5ac4d-579a-4daa-9daf-a042a69acac7","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"e2e5ac4d-579a-4daa-9daf-a042a69acac7","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"e2e5ac4d-579a-4daa-9daf-a042a69acac7","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"e2e5ac4d-579a-4daa-9daf-a042a69acac7","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"e2e5ac4d-579a-4daa-9daf-a042a69acac7"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"e2e5ac4d-579a-4daa-9daf-a042a69acac7","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":352871013,"seconds":1783442198}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":52320},"address":"10.133.0.32:52320"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e2e5ac4d-579a-4daa-9daf-a042a69acac7","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e2e5ac4d-579a-4daa-9daf-a042a69acac7","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e2e5ac4d-579a-4daa-9daf-a042a69acac7","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e2e5ac4d-579a-4daa-9daf-a042a69acac7","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:maas-admin:tester-admin-user"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"e2e5ac4d-579a-4daa-9daf-a042a69acac7","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e2e5ac4d-579a-4daa-9daf-a042a69acac7","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:maas-admin\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e2e5ac4d-579a-4daa-9daf-a042a69acac7","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e2e5ac4d-579a-4daa-9daf-a042a69acac7","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e2e5ac4d-579a-4daa-9daf-a042a69acac7","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a54c0a02-f945-4079-be56-f6589c4b2a2a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52336","PortSpecifier":{"PortValue":52336}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"a54c0a02-f945-4079-be56-f6589c4b2a2a","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a54c0a02-f945-4079-be56-f6589c4b2a2a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52336","PortSpecifier":{"PortValue":52336}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442198,"nanos":391578330},"http":{"id":"a54c0a02-f945-4079-be56-f6589c4b2a2a","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"a54c0a02-f945-4079-be56-f6589c4b2a2a","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a54c0a02-f945-4079-be56-f6589c4b2a2a","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a54c0a02-f945-4079-be56-f6589c4b2a2a","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"a54c0a02-f945-4079-be56-f6589c4b2a2a","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"a54c0a02-f945-4079-be56-f6589c4b2a2a"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"a54c0a02-f945-4079-be56-f6589c4b2a2a","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":391578330,"seconds":1783442198}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":52336},"address":"10.133.0.32:52336"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a54c0a02-f945-4079-be56-f6589c4b2a2a","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a54c0a02-f945-4079-be56-f6589c4b2a2a","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a54c0a02-f945-4079-be56-f6589c4b2a2a","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a54c0a02-f945-4079-be56-f6589c4b2a2a","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:maas-admin:tester-admin-user"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"a54c0a02-f945-4079-be56-f6589c4b2a2a","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a54c0a02-f945-4079-be56-f6589c4b2a2a","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a54c0a02-f945-4079-be56-f6589c4b2a2a","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:maas-admin\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a54c0a02-f945-4079-be56-f6589c4b2a2a","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a54c0a02-f945-4079-be56-f6589c4b2a2a","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e1e904a7-0415-4fe3-8f96-3ef795d10977","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52344","PortSpecifier":{"PortValue":52344}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"e1e904a7-0415-4fe3-8f96-3ef795d10977","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e1e904a7-0415-4fe3-8f96-3ef795d10977","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52344","PortSpecifier":{"PortValue":52344}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442198,"nanos":404406618},"http":{"id":"e1e904a7-0415-4fe3-8f96-3ef795d10977","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"e1e904a7-0415-4fe3-8f96-3ef795d10977","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"e1e904a7-0415-4fe3-8f96-3ef795d10977","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"e1e904a7-0415-4fe3-8f96-3ef795d10977","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"e1e904a7-0415-4fe3-8f96-3ef795d10977","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"e1e904a7-0415-4fe3-8f96-3ef795d10977"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"e1e904a7-0415-4fe3-8f96-3ef795d10977","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":404406618,"seconds":1783442198}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":52344},"address":"10.133.0.32:52344"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e1e904a7-0415-4fe3-8f96-3ef795d10977","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e1e904a7-0415-4fe3-8f96-3ef795d10977","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e1e904a7-0415-4fe3-8f96-3ef795d10977","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"e1e904a7-0415-4fe3-8f96-3ef795d10977","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e1e904a7-0415-4fe3-8f96-3ef795d10977","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e1e904a7-0415-4fe3-8f96-3ef795d10977","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:maas-admin:tester-admin-user"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e1e904a7-0415-4fe3-8f96-3ef795d10977","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:maas-admin\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e1e904a7-0415-4fe3-8f96-3ef795d10977","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e1e904a7-0415-4fe3-8f96-3ef795d10977","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"74ade74a-304c-4af9-b0db-278bc58855d3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52350","PortSpecifier":{"PortValue":52350}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"74ade74a-304c-4af9-b0db-278bc58855d3","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"74ade74a-304c-4af9-b0db-278bc58855d3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52350","PortSpecifier":{"PortValue":52350}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442198,"nanos":416593706},"http":{"id":"74ade74a-304c-4af9-b0db-278bc58855d3","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"74ade74a-304c-4af9-b0db-278bc58855d3","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"74ade74a-304c-4af9-b0db-278bc58855d3","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"74ade74a-304c-4af9-b0db-278bc58855d3","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"74ade74a-304c-4af9-b0db-278bc58855d3","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"74ade74a-304c-4af9-b0db-278bc58855d3"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"74ade74a-304c-4af9-b0db-278bc58855d3","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":416593706,"seconds":1783442198}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":52350},"address":"10.133.0.32:52350"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"74ade74a-304c-4af9-b0db-278bc58855d3","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"74ade74a-304c-4af9-b0db-278bc58855d3","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"74ade74a-304c-4af9-b0db-278bc58855d3","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"74ade74a-304c-4af9-b0db-278bc58855d3","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"74ade74a-304c-4af9-b0db-278bc58855d3","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:maas-admin:tester-admin-user"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"74ade74a-304c-4af9-b0db-278bc58855d3","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"74ade74a-304c-4af9-b0db-278bc58855d3","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:maas-admin\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"74ade74a-304c-4af9-b0db-278bc58855d3","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"74ade74a-304c-4af9-b0db-278bc58855d3","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"cfbd5a55-b5fe-4ee4-b17f-a1f4865b88f3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52358","PortSpecifier":{"PortValue":52358}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"cfbd5a55-b5fe-4ee4-b17f-a1f4865b88f3","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"cfbd5a55-b5fe-4ee4-b17f-a1f4865b88f3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52358","PortSpecifier":{"PortValue":52358}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442198,"nanos":429304059},"http":{"id":"cfbd5a55-b5fe-4ee4-b17f-a1f4865b88f3","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"cfbd5a55-b5fe-4ee4-b17f-a1f4865b88f3","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"cfbd5a55-b5fe-4ee4-b17f-a1f4865b88f3","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"cfbd5a55-b5fe-4ee4-b17f-a1f4865b88f3","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"cfbd5a55-b5fe-4ee4-b17f-a1f4865b88f3","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"cfbd5a55-b5fe-4ee4-b17f-a1f4865b88f3"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"cfbd5a55-b5fe-4ee4-b17f-a1f4865b88f3","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":429304059,"seconds":1783442198}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":52358},"address":"10.133.0.32:52358"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cfbd5a55-b5fe-4ee4-b17f-a1f4865b88f3","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cfbd5a55-b5fe-4ee4-b17f-a1f4865b88f3","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cfbd5a55-b5fe-4ee4-b17f-a1f4865b88f3","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"cfbd5a55-b5fe-4ee4-b17f-a1f4865b88f3","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cfbd5a55-b5fe-4ee4-b17f-a1f4865b88f3","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:maas-admin:tester-admin-user"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cfbd5a55-b5fe-4ee4-b17f-a1f4865b88f3","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cfbd5a55-b5fe-4ee4-b17f-a1f4865b88f3","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:maas-admin\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"cfbd5a55-b5fe-4ee4-b17f-a1f4865b88f3","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"cfbd5a55-b5fe-4ee4-b17f-a1f4865b88f3","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f9c49355-13e7-41ef-a5d8-495d443b2c38","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52364","PortSpecifier":{"PortValue":52364}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"f9c49355-13e7-41ef-a5d8-495d443b2c38","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f9c49355-13e7-41ef-a5d8-495d443b2c38","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52364","PortSpecifier":{"PortValue":52364}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442198,"nanos":442738414},"http":{"id":"f9c49355-13e7-41ef-a5d8-495d443b2c38","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"f9c49355-13e7-41ef-a5d8-495d443b2c38","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"f9c49355-13e7-41ef-a5d8-495d443b2c38","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"f9c49355-13e7-41ef-a5d8-495d443b2c38","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"f9c49355-13e7-41ef-a5d8-495d443b2c38","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"f9c49355-13e7-41ef-a5d8-495d443b2c38"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"f9c49355-13e7-41ef-a5d8-495d443b2c38","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":442738414,"seconds":1783442198}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":52364},"address":"10.133.0.32:52364"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f9c49355-13e7-41ef-a5d8-495d443b2c38","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f9c49355-13e7-41ef-a5d8-495d443b2c38","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f9c49355-13e7-41ef-a5d8-495d443b2c38","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"f9c49355-13e7-41ef-a5d8-495d443b2c38","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f9c49355-13e7-41ef-a5d8-495d443b2c38","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:maas-admin:tester-admin-user"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f9c49355-13e7-41ef-a5d8-495d443b2c38","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f9c49355-13e7-41ef-a5d8-495d443b2c38","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:maas-admin\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f9c49355-13e7-41ef-a5d8-495d443b2c38","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f9c49355-13e7-41ef-a5d8-495d443b2c38","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0cb28e0a-d5a1-443a-b79e-a25b307ced8b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52368","PortSpecifier":{"PortValue":52368}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"0cb28e0a-d5a1-443a-b79e-a25b307ced8b","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0cb28e0a-d5a1-443a-b79e-a25b307ced8b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52368","PortSpecifier":{"PortValue":52368}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442198,"nanos":455579335},"http":{"id":"0cb28e0a-d5a1-443a-b79e-a25b307ced8b","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"0cb28e0a-d5a1-443a-b79e-a25b307ced8b","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"0cb28e0a-d5a1-443a-b79e-a25b307ced8b","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"0cb28e0a-d5a1-443a-b79e-a25b307ced8b","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"0cb28e0a-d5a1-443a-b79e-a25b307ced8b","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"0cb28e0a-d5a1-443a-b79e-a25b307ced8b"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"0cb28e0a-d5a1-443a-b79e-a25b307ced8b","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":455579335,"seconds":1783442198}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":52368},"address":"10.133.0.32:52368"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0cb28e0a-d5a1-443a-b79e-a25b307ced8b","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0cb28e0a-d5a1-443a-b79e-a25b307ced8b","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0cb28e0a-d5a1-443a-b79e-a25b307ced8b","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"0cb28e0a-d5a1-443a-b79e-a25b307ced8b","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0cb28e0a-d5a1-443a-b79e-a25b307ced8b","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:maas-admin:tester-admin-user"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0cb28e0a-d5a1-443a-b79e-a25b307ced8b","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0cb28e0a-d5a1-443a-b79e-a25b307ced8b","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:maas-admin\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0cb28e0a-d5a1-443a-b79e-a25b307ced8b","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0cb28e0a-d5a1-443a-b79e-a25b307ced8b","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"43bc96e9-bd69-4a70-9044-168f399e57f0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52378","PortSpecifier":{"PortValue":52378}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"43bc96e9-bd69-4a70-9044-168f399e57f0","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"43bc96e9-bd69-4a70-9044-168f399e57f0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52378","PortSpecifier":{"PortValue":52378}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442198,"nanos":491165991},"http":{"id":"43bc96e9-bd69-4a70-9044-168f399e57f0","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"43bc96e9-bd69-4a70-9044-168f399e57f0","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"43bc96e9-bd69-4a70-9044-168f399e57f0","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"43bc96e9-bd69-4a70-9044-168f399e57f0","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"43bc96e9-bd69-4a70-9044-168f399e57f0","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"43bc96e9-bd69-4a70-9044-168f399e57f0"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"43bc96e9-bd69-4a70-9044-168f399e57f0","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":491165991,"seconds":1783442198}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":52378},"address":"10.133.0.32:52378"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"43bc96e9-bd69-4a70-9044-168f399e57f0","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"43bc96e9-bd69-4a70-9044-168f399e57f0","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"43bc96e9-bd69-4a70-9044-168f399e57f0","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"43bc96e9-bd69-4a70-9044-168f399e57f0","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"43bc96e9-bd69-4a70-9044-168f399e57f0","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:maas-admin:tester-admin-user"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"43bc96e9-bd69-4a70-9044-168f399e57f0","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"43bc96e9-bd69-4a70-9044-168f399e57f0","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:maas-admin\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"43bc96e9-bd69-4a70-9044-168f399e57f0","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"43bc96e9-bd69-4a70-9044-168f399e57f0","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d45d71d3-6d36-45f1-bec1-32994955ba14","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52392","PortSpecifier":{"PortValue":52392}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"d45d71d3-6d36-45f1-bec1-32994955ba14","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d45d71d3-6d36-45f1-bec1-32994955ba14","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52392","PortSpecifier":{"PortValue":52392}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442198,"nanos":504108743},"http":{"id":"d45d71d3-6d36-45f1-bec1-32994955ba14","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"d45d71d3-6d36-45f1-bec1-32994955ba14","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"d45d71d3-6d36-45f1-bec1-32994955ba14","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"d45d71d3-6d36-45f1-bec1-32994955ba14","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"d45d71d3-6d36-45f1-bec1-32994955ba14","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"d45d71d3-6d36-45f1-bec1-32994955ba14"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"d45d71d3-6d36-45f1-bec1-32994955ba14","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":504108743,"seconds":1783442198}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":52392},"address":"10.133.0.32:52392"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d45d71d3-6d36-45f1-bec1-32994955ba14","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d45d71d3-6d36-45f1-bec1-32994955ba14","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d45d71d3-6d36-45f1-bec1-32994955ba14","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d45d71d3-6d36-45f1-bec1-32994955ba14","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"d45d71d3-6d36-45f1-bec1-32994955ba14","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d45d71d3-6d36-45f1-bec1-32994955ba14","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:maas-admin\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d45d71d3-6d36-45f1-bec1-32994955ba14","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:maas-admin:tester-admin-user"}
{"level":"info","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d45d71d3-6d36-45f1-bec1-32994955ba14","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d45d71d3-6d36-45f1-bec1-32994955ba14","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"aedb77d8-f13b-40d3-ac24-f59848b2de2e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52394","PortSpecifier":{"PortValue":52394}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"aedb77d8-f13b-40d3-ac24-f59848b2de2e","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"aedb77d8-f13b-40d3-ac24-f59848b2de2e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52394","PortSpecifier":{"PortValue":52394}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442198,"nanos":517071669},"http":{"id":"aedb77d8-f13b-40d3-ac24-f59848b2de2e","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"aedb77d8-f13b-40d3-ac24-f59848b2de2e","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"aedb77d8-f13b-40d3-ac24-f59848b2de2e","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"aedb77d8-f13b-40d3-ac24-f59848b2de2e","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"aedb77d8-f13b-40d3-ac24-f59848b2de2e","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"aedb77d8-f13b-40d3-ac24-f59848b2de2e"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"aedb77d8-f13b-40d3-ac24-f59848b2de2e","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":517071669,"seconds":1783442198}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":52394},"address":"10.133.0.32:52394"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"aedb77d8-f13b-40d3-ac24-f59848b2de2e","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"aedb77d8-f13b-40d3-ac24-f59848b2de2e","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"aedb77d8-f13b-40d3-ac24-f59848b2de2e","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"aedb77d8-f13b-40d3-ac24-f59848b2de2e","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"aedb77d8-f13b-40d3-ac24-f59848b2de2e","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:maas-admin:tester-admin-user"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"aedb77d8-f13b-40d3-ac24-f59848b2de2e","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"aedb77d8-f13b-40d3-ac24-f59848b2de2e","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:maas-admin\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"aedb77d8-f13b-40d3-ac24-f59848b2de2e","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"aedb77d8-f13b-40d3-ac24-f59848b2de2e","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"65cb3a0e-bfc1-4682-a89d-bc4effcd410d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52396","PortSpecifier":{"PortValue":52396}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"65cb3a0e-bfc1-4682-a89d-bc4effcd410d","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"65cb3a0e-bfc1-4682-a89d-bc4effcd410d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52396","PortSpecifier":{"PortValue":52396}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442198,"nanos":530240986},"http":{"id":"65cb3a0e-bfc1-4682-a89d-bc4effcd410d","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"65cb3a0e-bfc1-4682-a89d-bc4effcd410d","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"65cb3a0e-bfc1-4682-a89d-bc4effcd410d","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"65cb3a0e-bfc1-4682-a89d-bc4effcd410d","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"65cb3a0e-bfc1-4682-a89d-bc4effcd410d","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"65cb3a0e-bfc1-4682-a89d-bc4effcd410d"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"65cb3a0e-bfc1-4682-a89d-bc4effcd410d","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":530240986,"seconds":1783442198}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":52396},"address":"10.133.0.32:52396"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"65cb3a0e-bfc1-4682-a89d-bc4effcd410d","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"65cb3a0e-bfc1-4682-a89d-bc4effcd410d","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"65cb3a0e-bfc1-4682-a89d-bc4effcd410d","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"65cb3a0e-bfc1-4682-a89d-bc4effcd410d","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:maas-admin:tester-admin-user"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"65cb3a0e-bfc1-4682-a89d-bc4effcd410d","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"65cb3a0e-bfc1-4682-a89d-bc4effcd410d","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"65cb3a0e-bfc1-4682-a89d-bc4effcd410d","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:maas-admin\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"65cb3a0e-bfc1-4682-a89d-bc4effcd410d","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"65cb3a0e-bfc1-4682-a89d-bc4effcd410d","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c2b29b42-7487-4acc-901b-d822694f0679","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:34022","PortSpecifier":{"PortValue":34022}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"c2b29b42-7487-4acc-901b-d822694f0679","method":"DELETE","path":"/maas-api/v1/api-keys/17f02a1d-801f-4933-abe2-92a9a3f1536e","host":"maas.apps.f8d243c7-e544-422f-be6e-b8b1f68b510f.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c2b29b42-7487-4acc-901b-d822694f0679","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:34022","PortSpecifier":{"PortValue":34022}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442198,"nanos":868764154},"http":{"id":"c2b29b42-7487-4acc-901b-d822694f0679","method":"DELETE","headers":{":authority":"maas.apps.f8d243c7-e544-422f-be6e-b8b1f68b510f.prod.konfluxeaas.com",":method":"DELETE",":path":"/maas-api/v1/api-keys/17f02a1d-801f-4933-abe2-92a9a3f1536e",":scheme":"https","accept":"*/*","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"c2b29b42-7487-4acc-901b-d822694f0679","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"c2b29b42-7487-4acc-901b-d822694f0679","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"c2b29b42-7487-4acc-901b-d822694f0679","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:maas-admin:tester-admin-user","uid":"c89d94c5-9627-401b-83f9-14508c428d40","groups":["system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=93247832-6568-4016-938d-8a7ceac3a6f9"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/b8b1f68b510f"]}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"c2b29b42-7487-4acc-901b-d822694f0679","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/b8b1f68b510f"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=93247832-6568-4016-938d-8a7ceac3a6f9"]},"groups":["system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"uid":"c89d94c5-9627-401b-83f9-14508c428d40","username":"system:serviceaccount:maas-admin:tester-admin-user"}}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.34:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.f8d243c7-e544-422f-be6e-b8b1f68b510f.prod.konfluxeaas.com",":method":"DELETE",":path":"/maas-api/v1/api-keys/17f02a1d-801f-4933-abe2-92a9a3f1536e",":scheme":"https","accept":"*/*","authorization":"Bearer **** ****REDACTED_JWT****","forwarded":"for=52.71.36.72;host=maas.apps.f8d243c7-e544-422f-be6e-b8b1f68b510f.prod.konfluxeaas.com;proto=https","user-agent":"curl/7.76.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.7","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"52.71.36.72,10.132.0.7","x-forwarded-host":"maas.apps.f8d243c7-e544-422f-be6e-b8b1f68b510f.prod.konfluxeaas.com","x-forwarded-port":"443","x-forwarded-proto":"https","x-request-id":"c2b29b42-7487-4acc-901b-d822694f0679"},"host":"maas.apps.f8d243c7-e544-422f-be6e-b8b1f68b510f.prod.konfluxeaas.com","id":"c2b29b42-7487-4acc-901b-d822694f0679","method":"DELETE","path":"/maas-api/v1/api-keys/17f02a1d-801f-4933-abe2-92a9a3f1536e","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":868764154,"seconds":1783442198},"url_path":"/maas-api/v1/api-keys/17f02a1d-801f-4933-abe2-92a9a3f1536e","user_agent":"curl/7.76.1"},"source":{"address":"10.132.0.7:34022","port":34022}}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c2b29b42-7487-4acc-901b-d822694f0679","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c2b29b42-7487-4acc-901b-d822694f0679","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c2b29b42-7487-4acc-901b-d822694f0679","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"c2b29b42-7487-4acc-901b-d822694f0679","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c2b29b42-7487-4acc-901b-d822694f0679","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:maas-admin:tester-admin-user"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c2b29b42-7487-4acc-901b-d822694f0679","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:maas-admin\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c2b29b42-7487-4acc-901b-d822694f0679","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c2b29b42-7487-4acc-901b-d822694f0679","authorized":true,"response":"OK"}