{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"43f837ad-a454-48ed-bfff-14b298f575ba","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"43f837ad-a454-48ed-bfff-14b298f575ba","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"43f837ad-a454-48ed-bfff-14b298f575ba","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"43f837ad-a454-48ed-bfff-14b298f575ba"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"43f837ad-a454-48ed-bfff-14b298f575ba","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":11746806,"seconds":1783442198}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":52122},"address":"10.133.0.32:52122"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"43f837ad-a454-48ed-bfff-14b298f575ba","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"info","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"43f837ad-a454-48ed-bfff-14b298f575ba","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"43f837ad-a454-48ed-bfff-14b298f575ba","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"172f31e0-91ef-43f1-bd72-23621d6eabb8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52132","PortSpecifier":{"PortValue":52132}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"172f31e0-91ef-43f1-bd72-23621d6eabb8","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"172f31e0-91ef-43f1-bd72-23621d6eabb8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52132","PortSpecifier":{"PortValue":52132}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442198,"nanos":24356544},"http":{"id":"172f31e0-91ef-43f1-bd72-23621d6eabb8","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"172f31e0-91ef-43f1-bd72-23621d6eabb8","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"172f31e0-91ef-43f1-bd72-23621d6eabb8","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"172f31e0-91ef-43f1-bd72-23621d6eabb8","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"172f31e0-91ef-43f1-bd72-23621d6eabb8","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"172f31e0-91ef-43f1-bd72-23621d6eabb8"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"172f31e0-91ef-43f1-bd72-23621d6eabb8","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":24356544,"seconds":1783442198}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":52132},"address":"10.133.0.32:52132"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"172f31e0-91ef-43f1-bd72-23621d6eabb8","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"172f31e0-91ef-43f1-bd72-23621d6eabb8","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"172f31e0-91ef-43f1-bd72-23621d6eabb8","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"172f31e0-91ef-43f1-bd72-23621d6eabb8","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"172f31e0-91ef-43f1-bd72-23621d6eabb8","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:maas-admin:tester-admin-user"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"172f31e0-91ef-43f1-bd72-23621d6eabb8","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"172f31e0-91ef-43f1-bd72-23621d6eabb8","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:maas-admin\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"172f31e0-91ef-43f1-bd72-23621d6eabb8","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"172f31e0-91ef-43f1-bd72-23621d6eabb8","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6c902f47-575c-4136-a3a2-fa749c3a2c14","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52134","PortSpecifier":{"PortValue":52134}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"6c902f47-575c-4136-a3a2-fa749c3a2c14","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6c902f47-575c-4136-a3a2-fa749c3a2c14","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52134","PortSpecifier":{"PortValue":52134}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442198,"nanos":36872982},"http":{"id":"6c902f47-575c-4136-a3a2-fa749c3a2c14","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"6c902f47-575c-4136-a3a2-fa749c3a2c14","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"6c902f47-575c-4136-a3a2-fa749c3a2c14","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"6c902f47-575c-4136-a3a2-fa749c3a2c14","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"6c902f47-575c-4136-a3a2-fa749c3a2c14","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"6c902f47-575c-4136-a3a2-fa749c3a2c14"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"6c902f47-575c-4136-a3a2-fa749c3a2c14","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":36872982,"seconds":1783442198}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":52134},"address":"10.133.0.32:52134"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6c902f47-575c-4136-a3a2-fa749c3a2c14","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6c902f47-575c-4136-a3a2-fa749c3a2c14","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6c902f47-575c-4136-a3a2-fa749c3a2c14","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6c902f47-575c-4136-a3a2-fa749c3a2c14","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:maas-admin:tester-admin-user"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"6c902f47-575c-4136-a3a2-fa749c3a2c14","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6c902f47-575c-4136-a3a2-fa749c3a2c14","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:maas-admin\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6c902f47-575c-4136-a3a2-fa749c3a2c14","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6c902f47-575c-4136-a3a2-fa749c3a2c14","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6c902f47-575c-4136-a3a2-fa749c3a2c14","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"93293636-ca77-46bd-9da5-e3e590fc98f3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52140","PortSpecifier":{"PortValue":52140}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"93293636-ca77-46bd-9da5-e3e590fc98f3","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"93293636-ca77-46bd-9da5-e3e590fc98f3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52140","PortSpecifier":{"PortValue":52140}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442198,"nanos":49305902},"http":{"id":"93293636-ca77-46bd-9da5-e3e590fc98f3","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"93293636-ca77-46bd-9da5-e3e590fc98f3","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"93293636-ca77-46bd-9da5-e3e590fc98f3","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"93293636-ca77-46bd-9da5-e3e590fc98f3","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"93293636-ca77-46bd-9da5-e3e590fc98f3","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"93293636-ca77-46bd-9da5-e3e590fc98f3"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"93293636-ca77-46bd-9da5-e3e590fc98f3","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":49305902,"seconds":1783442198}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":52140},"address":"10.133.0.32:52140"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"93293636-ca77-46bd-9da5-e3e590fc98f3","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"93293636-ca77-46bd-9da5-e3e590fc98f3","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"93293636-ca77-46bd-9da5-e3e590fc98f3","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"93293636-ca77-46bd-9da5-e3e590fc98f3","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:maas-admin:tester-admin-user"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"93293636-ca77-46bd-9da5-e3e590fc98f3","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"93293636-ca77-46bd-9da5-e3e590fc98f3","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"93293636-ca77-46bd-9da5-e3e590fc98f3","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:maas-admin\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"93293636-ca77-46bd-9da5-e3e590fc98f3","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"93293636-ca77-46bd-9da5-e3e590fc98f3","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5f372580-27ac-439d-bce4-582914a846b7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52146","PortSpecifier":{"PortValue":52146}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"5f372580-27ac-439d-bce4-582914a846b7","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5f372580-27ac-439d-bce4-582914a846b7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52146","PortSpecifier":{"PortValue":52146}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442198,"nanos":61648589},"http":{"id":"5f372580-27ac-439d-bce4-582914a846b7","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"5f372580-27ac-439d-bce4-582914a846b7","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"5f372580-27ac-439d-bce4-582914a846b7","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"5f372580-27ac-439d-bce4-582914a846b7","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"5f372580-27ac-439d-bce4-582914a846b7","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"5f372580-27ac-439d-bce4-582914a846b7"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"5f372580-27ac-439d-bce4-582914a846b7","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":61648589,"seconds":1783442198}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":52146},"address":"10.133.0.32:52146"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5f372580-27ac-439d-bce4-582914a846b7","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5f372580-27ac-439d-bce4-582914a846b7","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5f372580-27ac-439d-bce4-582914a846b7","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5f372580-27ac-439d-bce4-582914a846b7","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:maas-admin:tester-admin-user"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"5f372580-27ac-439d-bce4-582914a846b7","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5f372580-27ac-439d-bce4-582914a846b7","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5f372580-27ac-439d-bce4-582914a846b7","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:maas-admin\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5f372580-27ac-439d-bce4-582914a846b7","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5f372580-27ac-439d-bce4-582914a846b7","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"90fae4c2-bfd3-41d0-a5d9-85741a823de0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52158","PortSpecifier":{"PortValue":52158}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"90fae4c2-bfd3-41d0-a5d9-85741a823de0","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"90fae4c2-bfd3-41d0-a5d9-85741a823de0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52158","PortSpecifier":{"PortValue":52158}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442198,"nanos":98426989},"http":{"id":"90fae4c2-bfd3-41d0-a5d9-85741a823de0","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"90fae4c2-bfd3-41d0-a5d9-85741a823de0","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"90fae4c2-bfd3-41d0-a5d9-85741a823de0","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"90fae4c2-bfd3-41d0-a5d9-85741a823de0","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"90fae4c2-bfd3-41d0-a5d9-85741a823de0","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"90fae4c2-bfd3-41d0-a5d9-85741a823de0"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"90fae4c2-bfd3-41d0-a5d9-85741a823de0","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":98426989,"seconds":1783442198}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":52158},"address":"10.133.0.32:52158"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"90fae4c2-bfd3-41d0-a5d9-85741a823de0","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"90fae4c2-bfd3-41d0-a5d9-85741a823de0","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"90fae4c2-bfd3-41d0-a5d9-85741a823de0","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"90fae4c2-bfd3-41d0-a5d9-85741a823de0","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"90fae4c2-bfd3-41d0-a5d9-85741a823de0","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:maas-admin:tester-admin-user"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"90fae4c2-bfd3-41d0-a5d9-85741a823de0","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:maas-admin\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"90fae4c2-bfd3-41d0-a5d9-85741a823de0","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"90fae4c2-bfd3-41d0-a5d9-85741a823de0","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"90fae4c2-bfd3-41d0-a5d9-85741a823de0","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"20328cd3-ee61-4f47-a556-146ef5462dd5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52174","PortSpecifier":{"PortValue":52174}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"20328cd3-ee61-4f47-a556-146ef5462dd5","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"20328cd3-ee61-4f47-a556-146ef5462dd5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52174","PortSpecifier":{"PortValue":52174}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442198,"nanos":111145748},"http":{"id":"20328cd3-ee61-4f47-a556-146ef5462dd5","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"20328cd3-ee61-4f47-a556-146ef5462dd5","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"20328cd3-ee61-4f47-a556-146ef5462dd5","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"20328cd3-ee61-4f47-a556-146ef5462dd5","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"20328cd3-ee61-4f47-a556-146ef5462dd5","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"20328cd3-ee61-4f47-a556-146ef5462dd5"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"20328cd3-ee61-4f47-a556-146ef5462dd5","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":111145748,"seconds":1783442198}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":52174},"address":"10.133.0.32:52174"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"20328cd3-ee61-4f47-a556-146ef5462dd5","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"20328cd3-ee61-4f47-a556-146ef5462dd5","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"20328cd3-ee61-4f47-a556-146ef5462dd5","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"20328cd3-ee61-4f47-a556-146ef5462dd5","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"20328cd3-ee61-4f47-a556-146ef5462dd5","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:maas-admin:tester-admin-user"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"20328cd3-ee61-4f47-a556-146ef5462dd5","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"20328cd3-ee61-4f47-a556-146ef5462dd5","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:maas-admin\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"20328cd3-ee61-4f47-a556-146ef5462dd5","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"20328cd3-ee61-4f47-a556-146ef5462dd5","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"304bc4ec-b6b6-42c6-b431-424ee89d9171","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52186","PortSpecifier":{"PortValue":52186}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"304bc4ec-b6b6-42c6-b431-424ee89d9171","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"304bc4ec-b6b6-42c6-b431-424ee89d9171","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52186","PortSpecifier":{"PortValue":52186}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442198,"nanos":123973524},"http":{"id":"304bc4ec-b6b6-42c6-b431-424ee89d9171","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"304bc4ec-b6b6-42c6-b431-424ee89d9171","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"304bc4ec-b6b6-42c6-b431-424ee89d9171","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"304bc4ec-b6b6-42c6-b431-424ee89d9171","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"304bc4ec-b6b6-42c6-b431-424ee89d9171","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"304bc4ec-b6b6-42c6-b431-424ee89d9171"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"304bc4ec-b6b6-42c6-b431-424ee89d9171","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":123973524,"seconds":1783442198}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":52186},"address":"10.133.0.32:52186"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"304bc4ec-b6b6-42c6-b431-424ee89d9171","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"304bc4ec-b6b6-42c6-b431-424ee89d9171","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"304bc4ec-b6b6-42c6-b431-424ee89d9171","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"304bc4ec-b6b6-42c6-b431-424ee89d9171","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"304bc4ec-b6b6-42c6-b431-424ee89d9171","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:maas-admin:tester-admin-user"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"304bc4ec-b6b6-42c6-b431-424ee89d9171","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"304bc4ec-b6b6-42c6-b431-424ee89d9171","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:maas-admin\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"304bc4ec-b6b6-42c6-b431-424ee89d9171","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"304bc4ec-b6b6-42c6-b431-424ee89d9171","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"74fe707a-adeb-4ada-9c52-931e75f7286e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52194","PortSpecifier":{"PortValue":52194}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"74fe707a-adeb-4ada-9c52-931e75f7286e","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"74fe707a-adeb-4ada-9c52-931e75f7286e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52194","PortSpecifier":{"PortValue":52194}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442198,"nanos":136232740},"http":{"id":"74fe707a-adeb-4ada-9c52-931e75f7286e","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"74fe707a-adeb-4ada-9c52-931e75f7286e","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"74fe707a-adeb-4ada-9c52-931e75f7286e","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"74fe707a-adeb-4ada-9c52-931e75f7286e","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"74fe707a-adeb-4ada-9c52-931e75f7286e","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"74fe707a-adeb-4ada-9c52-931e75f7286e"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"74fe707a-adeb-4ada-9c52-931e75f7286e","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":136232740,"seconds":1783442198}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":52194},"address":"10.133.0.32:52194"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"74fe707a-adeb-4ada-9c52-931e75f7286e","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"74fe707a-adeb-4ada-9c52-931e75f7286e","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"74fe707a-adeb-4ada-9c52-931e75f7286e","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"74fe707a-adeb-4ada-9c52-931e75f7286e","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"74fe707a-adeb-4ada-9c52-931e75f7286e","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:maas-admin:tester-admin-user"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"74fe707a-adeb-4ada-9c52-931e75f7286e","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:maas-admin\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"74fe707a-adeb-4ada-9c52-931e75f7286e","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"74fe707a-adeb-4ada-9c52-931e75f7286e","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"74fe707a-adeb-4ada-9c52-931e75f7286e","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3f278300-65a7-411a-82f9-6520732d65b3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52202","PortSpecifier":{"PortValue":52202}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"3f278300-65a7-411a-82f9-6520732d65b3","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3f278300-65a7-411a-82f9-6520732d65b3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52202","PortSpecifier":{"PortValue":52202}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442198,"nanos":148320486},"http":{"id":"3f278300-65a7-411a-82f9-6520732d65b3","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"3f278300-65a7-411a-82f9-6520732d65b3","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"3f278300-65a7-411a-82f9-6520732d65b3","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"3f278300-65a7-411a-82f9-6520732d65b3","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"3f278300-65a7-411a-82f9-6520732d65b3","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"3f278300-65a7-411a-82f9-6520732d65b3"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"3f278300-65a7-411a-82f9-6520732d65b3","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":148320486,"seconds":1783442198}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":52202},"address":"10.133.0.32:52202"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3f278300-65a7-411a-82f9-6520732d65b3","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3f278300-65a7-411a-82f9-6520732d65b3","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3f278300-65a7-411a-82f9-6520732d65b3","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"3f278300-65a7-411a-82f9-6520732d65b3","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3f278300-65a7-411a-82f9-6520732d65b3","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3f278300-65a7-411a-82f9-6520732d65b3","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:maas-admin:tester-admin-user"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3f278300-65a7-411a-82f9-6520732d65b3","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:maas-admin\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3f278300-65a7-411a-82f9-6520732d65b3","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3f278300-65a7-411a-82f9-6520732d65b3","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"fff1882e-22a5-4f36-995a-db5bd77b4c52","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52208","PortSpecifier":{"PortValue":52208}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"fff1882e-22a5-4f36-995a-db5bd77b4c52","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"fff1882e-22a5-4f36-995a-db5bd77b4c52","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52208","PortSpecifier":{"PortValue":52208}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442198,"nanos":160363114},"http":{"id":"fff1882e-22a5-4f36-995a-db5bd77b4c52","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"fff1882e-22a5-4f36-995a-db5bd77b4c52","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"fff1882e-22a5-4f36-995a-db5bd77b4c52","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"fff1882e-22a5-4f36-995a-db5bd77b4c52","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"fff1882e-22a5-4f36-995a-db5bd77b4c52","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"fff1882e-22a5-4f36-995a-db5bd77b4c52"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"fff1882e-22a5-4f36-995a-db5bd77b4c52","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":160363114,"seconds":1783442198}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":52208},"address":"10.133.0.32:52208"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fff1882e-22a5-4f36-995a-db5bd77b4c52","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fff1882e-22a5-4f36-995a-db5bd77b4c52","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fff1882e-22a5-4f36-995a-db5bd77b4c52","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"fff1882e-22a5-4f36-995a-db5bd77b4c52","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"fff1882e-22a5-4f36-995a-db5bd77b4c52","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:maas-admin\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"fff1882e-22a5-4f36-995a-db5bd77b4c52","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:maas-admin:tester-admin-user"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"fff1882e-22a5-4f36-995a-db5bd77b4c52","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"fff1882e-22a5-4f36-995a-db5bd77b4c52","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"fff1882e-22a5-4f36-995a-db5bd77b4c52","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"eeb41dea-e389-451b-9ce9-cc9aec508605","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52218","PortSpecifier":{"PortValue":52218}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"eeb41dea-e389-451b-9ce9-cc9aec508605","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"eeb41dea-e389-451b-9ce9-cc9aec508605","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52218","PortSpecifier":{"PortValue":52218}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442198,"nanos":190967482},"http":{"id":"eeb41dea-e389-451b-9ce9-cc9aec508605","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"eeb41dea-e389-451b-9ce9-cc9aec508605","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"eeb41dea-e389-451b-9ce9-cc9aec508605","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"eeb41dea-e389-451b-9ce9-cc9aec508605","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"eeb41dea-e389-451b-9ce9-cc9aec508605","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"eeb41dea-e389-451b-9ce9-cc9aec508605"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"eeb41dea-e389-451b-9ce9-cc9aec508605","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":190967482,"seconds":1783442198}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":52218},"address":"10.133.0.32:52218"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"eeb41dea-e389-451b-9ce9-cc9aec508605","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"eeb41dea-e389-451b-9ce9-cc9aec508605","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"eeb41dea-e389-451b-9ce9-cc9aec508605","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"eeb41dea-e389-451b-9ce9-cc9aec508605","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"eeb41dea-e389-451b-9ce9-cc9aec508605","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:maas-admin:tester-admin-user"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"eeb41dea-e389-451b-9ce9-cc9aec508605","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:maas-admin\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"eeb41dea-e389-451b-9ce9-cc9aec508605","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"eeb41dea-e389-451b-9ce9-cc9aec508605","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"eeb41dea-e389-451b-9ce9-cc9aec508605","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b72bd8c0-1045-4414-a969-d6c8e255c5cb","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52222","PortSpecifier":{"PortValue":52222}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"b72bd8c0-1045-4414-a969-d6c8e255c5cb","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b72bd8c0-1045-4414-a969-d6c8e255c5cb","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52222","PortSpecifier":{"PortValue":52222}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442198,"nanos":204116288},"http":{"id":"b72bd8c0-1045-4414-a969-d6c8e255c5cb","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"b72bd8c0-1045-4414-a969-d6c8e255c5cb","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"b72bd8c0-1045-4414-a969-d6c8e255c5cb","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"b72bd8c0-1045-4414-a969-d6c8e255c5cb","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"b72bd8c0-1045-4414-a969-d6c8e255c5cb","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"b72bd8c0-1045-4414-a969-d6c8e255c5cb"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"b72bd8c0-1045-4414-a969-d6c8e255c5cb","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":204116288,"seconds":1783442198}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":52222},"address":"10.133.0.32:52222"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b72bd8c0-1045-4414-a969-d6c8e255c5cb","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b72bd8c0-1045-4414-a969-d6c8e255c5cb","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b72bd8c0-1045-4414-a969-d6c8e255c5cb","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b72bd8c0-1045-4414-a969-d6c8e255c5cb","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:maas-admin:tester-admin-user"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"b72bd8c0-1045-4414-a969-d6c8e255c5cb","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b72bd8c0-1045-4414-a969-d6c8e255c5cb","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b72bd8c0-1045-4414-a969-d6c8e255c5cb","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:maas-admin\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b72bd8c0-1045-4414-a969-d6c8e255c5cb","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b72bd8c0-1045-4414-a969-d6c8e255c5cb","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5e18e9eb-8b0f-4dc1-b55c-3426de3c8f4d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52232","PortSpecifier":{"PortValue":52232}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"5e18e9eb-8b0f-4dc1-b55c-3426de3c8f4d","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5e18e9eb-8b0f-4dc1-b55c-3426de3c8f4d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52232","PortSpecifier":{"PortValue":52232}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442198,"nanos":216752182},"http":{"id":"5e18e9eb-8b0f-4dc1-b55c-3426de3c8f4d","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"5e18e9eb-8b0f-4dc1-b55c-3426de3c8f4d","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"5e18e9eb-8b0f-4dc1-b55c-3426de3c8f4d","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"5e18e9eb-8b0f-4dc1-b55c-3426de3c8f4d","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"5e18e9eb-8b0f-4dc1-b55c-3426de3c8f4d","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"5e18e9eb-8b0f-4dc1-b55c-3426de3c8f4d"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"5e18e9eb-8b0f-4dc1-b55c-3426de3c8f4d","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":216752182,"seconds":1783442198}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":52232},"address":"10.133.0.32:52232"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5e18e9eb-8b0f-4dc1-b55c-3426de3c8f4d","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5e18e9eb-8b0f-4dc1-b55c-3426de3c8f4d","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5e18e9eb-8b0f-4dc1-b55c-3426de3c8f4d","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"5e18e9eb-8b0f-4dc1-b55c-3426de3c8f4d","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5e18e9eb-8b0f-4dc1-b55c-3426de3c8f4d","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:maas-admin:tester-admin-user"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5e18e9eb-8b0f-4dc1-b55c-3426de3c8f4d","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:maas-admin\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5e18e9eb-8b0f-4dc1-b55c-3426de3c8f4d","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5e18e9eb-8b0f-4dc1-b55c-3426de3c8f4d","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5e18e9eb-8b0f-4dc1-b55c-3426de3c8f4d","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f526e62a-26dc-4423-a163-2625d041cf1a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52242","PortSpecifier":{"PortValue":52242}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"f526e62a-26dc-4423-a163-2625d041cf1a","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f526e62a-26dc-4423-a163-2625d041cf1a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52242","PortSpecifier":{"PortValue":52242}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442198,"nanos":229173079},"http":{"id":"f526e62a-26dc-4423-a163-2625d041cf1a","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"f526e62a-26dc-4423-a163-2625d041cf1a","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"f526e62a-26dc-4423-a163-2625d041cf1a","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"f526e62a-26dc-4423-a163-2625d041cf1a","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"f526e62a-26dc-4423-a163-2625d041cf1a","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"f526e62a-26dc-4423-a163-2625d041cf1a"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"f526e62a-26dc-4423-a163-2625d041cf1a","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":229173079,"seconds":1783442198}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":52242},"address":"10.133.0.32:52242"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f526e62a-26dc-4423-a163-2625d041cf1a","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f526e62a-26dc-4423-a163-2625d041cf1a","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f526e62a-26dc-4423-a163-2625d041cf1a","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"f526e62a-26dc-4423-a163-2625d041cf1a","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f526e62a-26dc-4423-a163-2625d041cf1a","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:maas-admin:tester-admin-user"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f526e62a-26dc-4423-a163-2625d041cf1a","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f526e62a-26dc-4423-a163-2625d041cf1a","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:maas-admin\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f526e62a-26dc-4423-a163-2625d041cf1a","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f526e62a-26dc-4423-a163-2625d041cf1a","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8d1013ae-cfb3-4deb-9393-f45e94fffa32","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52248","PortSpecifier":{"PortValue":52248}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"8d1013ae-cfb3-4deb-9393-f45e94fffa32","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8d1013ae-cfb3-4deb-9393-f45e94fffa32","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52248","PortSpecifier":{"PortValue":52248}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442198,"nanos":242420869},"http":{"id":"8d1013ae-cfb3-4deb-9393-f45e94fffa32","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"8d1013ae-cfb3-4deb-9393-f45e94fffa32","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"8d1013ae-cfb3-4deb-9393-f45e94fffa32","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"8d1013ae-cfb3-4deb-9393-f45e94fffa32","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"8d1013ae-cfb3-4deb-9393-f45e94fffa32","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"8d1013ae-cfb3-4deb-9393-f45e94fffa32"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"8d1013ae-cfb3-4deb-9393-f45e94fffa32","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":242420869,"seconds":1783442198}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":52248},"address":"10.133.0.32:52248"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8d1013ae-cfb3-4deb-9393-f45e94fffa32","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8d1013ae-cfb3-4deb-9393-f45e94fffa32","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8d1013ae-cfb3-4deb-9393-f45e94fffa32","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"8d1013ae-cfb3-4deb-9393-f45e94fffa32","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8d1013ae-cfb3-4deb-9393-f45e94fffa32","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:maas-admin:tester-admin-user"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8d1013ae-cfb3-4deb-9393-f45e94fffa32","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8d1013ae-cfb3-4deb-9393-f45e94fffa32","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:maas-admin\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8d1013ae-cfb3-4deb-9393-f45e94fffa32","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8d1013ae-cfb3-4deb-9393-f45e94fffa32","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6e15222c-373e-4d5b-bae5-0a6d63ec2867","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52250","PortSpecifier":{"PortValue":52250}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"6e15222c-373e-4d5b-bae5-0a6d63ec2867","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6e15222c-373e-4d5b-bae5-0a6d63ec2867","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52250","PortSpecifier":{"PortValue":52250}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442198,"nanos":255246636},"http":{"id":"6e15222c-373e-4d5b-bae5-0a6d63ec2867","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"6e15222c-373e-4d5b-bae5-0a6d63ec2867","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"6e15222c-373e-4d5b-bae5-0a6d63ec2867","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"6e15222c-373e-4d5b-bae5-0a6d63ec2867","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"6e15222c-373e-4d5b-bae5-0a6d63ec2867","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"6e15222c-373e-4d5b-bae5-0a6d63ec2867"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"6e15222c-373e-4d5b-bae5-0a6d63ec2867","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":255246636,"seconds":1783442198}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":52250},"address":"10.133.0.32:52250"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6e15222c-373e-4d5b-bae5-0a6d63ec2867","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6e15222c-373e-4d5b-bae5-0a6d63ec2867","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6e15222c-373e-4d5b-bae5-0a6d63ec2867","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"6e15222c-373e-4d5b-bae5-0a6d63ec2867","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6e15222c-373e-4d5b-bae5-0a6d63ec2867","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:maas-admin:tester-admin-user"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6e15222c-373e-4d5b-bae5-0a6d63ec2867","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:maas-admin\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6e15222c-373e-4d5b-bae5-0a6d63ec2867","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6e15222c-373e-4d5b-bae5-0a6d63ec2867","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6e15222c-373e-4d5b-bae5-0a6d63ec2867","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7f16ef08-445f-4b46-ad3c-919a39d22df8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52260","PortSpecifier":{"PortValue":52260}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"7f16ef08-445f-4b46-ad3c-919a39d22df8","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7f16ef08-445f-4b46-ad3c-919a39d22df8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52260","PortSpecifier":{"PortValue":52260}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442198,"nanos":290879728},"http":{"id":"7f16ef08-445f-4b46-ad3c-919a39d22df8","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"7f16ef08-445f-4b46-ad3c-919a39d22df8","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"7f16ef08-445f-4b46-ad3c-919a39d22df8","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"7f16ef08-445f-4b46-ad3c-919a39d22df8","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"7f16ef08-445f-4b46-ad3c-919a39d22df8","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"7f16ef08-445f-4b46-ad3c-919a39d22df8"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"7f16ef08-445f-4b46-ad3c-919a39d22df8","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":290879728,"seconds":1783442198}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":52260},"address":"10.133.0.32:52260"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7f16ef08-445f-4b46-ad3c-919a39d22df8","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7f16ef08-445f-4b46-ad3c-919a39d22df8","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7f16ef08-445f-4b46-ad3c-919a39d22df8","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"7f16ef08-445f-4b46-ad3c-919a39d22df8","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7f16ef08-445f-4b46-ad3c-919a39d22df8","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7f16ef08-445f-4b46-ad3c-919a39d22df8","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:maas-admin:tester-admin-user"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7f16ef08-445f-4b46-ad3c-919a39d22df8","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:maas-admin\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7f16ef08-445f-4b46-ad3c-919a39d22df8","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7f16ef08-445f-4b46-ad3c-919a39d22df8","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6e28c735-fe0e-4a5c-9905-d5b9efac16fd","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52266","PortSpecifier":{"PortValue":52266}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"6e28c735-fe0e-4a5c-9905-d5b9efac16fd","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6e28c735-fe0e-4a5c-9905-d5b9efac16fd","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52266","PortSpecifier":{"PortValue":52266}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442198,"nanos":303619014},"http":{"id":"6e28c735-fe0e-4a5c-9905-d5b9efac16fd","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"6e28c735-fe0e-4a5c-9905-d5b9efac16fd","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"6e28c735-fe0e-4a5c-9905-d5b9efac16fd","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"6e28c735-fe0e-4a5c-9905-d5b9efac16fd","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"6e28c735-fe0e-4a5c-9905-d5b9efac16fd","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"6e28c735-fe0e-4a5c-9905-d5b9efac16fd"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"6e28c735-fe0e-4a5c-9905-d5b9efac16fd","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":303619014,"seconds":1783442198}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":52266},"address":"10.133.0.32:52266"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6e28c735-fe0e-4a5c-9905-d5b9efac16fd","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6e28c735-fe0e-4a5c-9905-d5b9efac16fd","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6e28c735-fe0e-4a5c-9905-d5b9efac16fd","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"6e28c735-fe0e-4a5c-9905-d5b9efac16fd","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6e28c735-fe0e-4a5c-9905-d5b9efac16fd","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6e28c735-fe0e-4a5c-9905-d5b9efac16fd","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:maas-admin:tester-admin-user"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6e28c735-fe0e-4a5c-9905-d5b9efac16fd","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:maas-admin\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6e28c735-fe0e-4a5c-9905-d5b9efac16fd","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6e28c735-fe0e-4a5c-9905-d5b9efac16fd","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1fb132d3-275d-436e-acea-0087cf1c9e05","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52280","PortSpecifier":{"PortValue":52280}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"1fb132d3-275d-436e-acea-0087cf1c9e05","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1fb132d3-275d-436e-acea-0087cf1c9e05","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52280","PortSpecifier":{"PortValue":52280}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442198,"nanos":315999153},"http":{"id":"1fb132d3-275d-436e-acea-0087cf1c9e05","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"1fb132d3-275d-436e-acea-0087cf1c9e05","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"1fb132d3-275d-436e-acea-0087cf1c9e05","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"1fb132d3-275d-436e-acea-0087cf1c9e05","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"1fb132d3-275d-436e-acea-0087cf1c9e05","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"1fb132d3-275d-436e-acea-0087cf1c9e05"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"1fb132d3-275d-436e-acea-0087cf1c9e05","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":315999153,"seconds":1783442198}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":52280},"address":"10.133.0.32:52280"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1fb132d3-275d-436e-acea-0087cf1c9e05","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1fb132d3-275d-436e-acea-0087cf1c9e05","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1fb132d3-275d-436e-acea-0087cf1c9e05","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"1fb132d3-275d-436e-acea-0087cf1c9e05","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1fb132d3-275d-436e-acea-0087cf1c9e05","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:maas-admin:tester-admin-user"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1fb132d3-275d-436e-acea-0087cf1c9e05","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1fb132d3-275d-436e-acea-0087cf1c9e05","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:maas-admin\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1fb132d3-275d-436e-acea-0087cf1c9e05","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1fb132d3-275d-436e-acea-0087cf1c9e05","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"4e8a3f72-f8a0-4e59-bab4-f0d7bc867f72","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52290","PortSpecifier":{"PortValue":52290}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"4e8a3f72-f8a0-4e59-bab4-f0d7bc867f72","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"4e8a3f72-f8a0-4e59-bab4-f0d7bc867f72","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52290","PortSpecifier":{"PortValue":52290}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442198,"nanos":328162763},"http":{"id":"4e8a3f72-f8a0-4e59-bab4-f0d7bc867f72","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"4e8a3f72-f8a0-4e59-bab4-f0d7bc867f72","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"4e8a3f72-f8a0-4e59-bab4-f0d7bc867f72","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"4e8a3f72-f8a0-4e59-bab4-f0d7bc867f72","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"4e8a3f72-f8a0-4e59-bab4-f0d7bc867f72","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"4e8a3f72-f8a0-4e59-bab4-f0d7bc867f72"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"4e8a3f72-f8a0-4e59-bab4-f0d7bc867f72","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":328162763,"seconds":1783442198}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":52290},"address":"10.133.0.32:52290"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4e8a3f72-f8a0-4e59-bab4-f0d7bc867f72","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4e8a3f72-f8a0-4e59-bab4-f0d7bc867f72","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4e8a3f72-f8a0-4e59-bab4-f0d7bc867f72","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4e8a3f72-f8a0-4e59-bab4-f0d7bc867f72","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:maas-admin:tester-admin-user"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"4e8a3f72-f8a0-4e59-bab4-f0d7bc867f72","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4e8a3f72-f8a0-4e59-bab4-f0d7bc867f72","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:maas-admin\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4e8a3f72-f8a0-4e59-bab4-f0d7bc867f72","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4e8a3f72-f8a0-4e59-bab4-f0d7bc867f72","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4e8a3f72-f8a0-4e59-bab4-f0d7bc867f72","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"23043059-f278-47b9-8f2a-b3f1a5da5508","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52304","PortSpecifier":{"PortValue":52304}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"23043059-f278-47b9-8f2a-b3f1a5da5508","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"23043059-f278-47b9-8f2a-b3f1a5da5508","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52304","PortSpecifier":{"PortValue":52304}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442198,"nanos":340729861},"http":{"id":"23043059-f278-47b9-8f2a-b3f1a5da5508","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"23043059-f278-47b9-8f2a-b3f1a5da5508","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"23043059-f278-47b9-8f2a-b3f1a5da5508","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"23043059-f278-47b9-8f2a-b3f1a5da5508","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"23043059-f278-47b9-8f2a-b3f1a5da5508","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"23043059-f278-47b9-8f2a-b3f1a5da5508"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"23043059-f278-47b9-8f2a-b3f1a5da5508","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":340729861,"seconds":1783442198}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":52304},"address":"10.133.0.32:52304"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"23043059-f278-47b9-8f2a-b3f1a5da5508","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"23043059-f278-47b9-8f2a-b3f1a5da5508","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"23043059-f278-47b9-8f2a-b3f1a5da5508","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"23043059-f278-47b9-8f2a-b3f1a5da5508","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:maas-admin:tester-admin-user"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"23043059-f278-47b9-8f2a-b3f1a5da5508","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"23043059-f278-47b9-8f2a-b3f1a5da5508","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:maas-admin\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"23043059-f278-47b9-8f2a-b3f1a5da5508","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"23043059-f278-47b9-8f2a-b3f1a5da5508","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"23043059-f278-47b9-8f2a-b3f1a5da5508","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e2e5ac4d-579a-4daa-9daf-a042a69acac7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52320","PortSpecifier":{"PortValue":52320}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"e2e5ac4d-579a-4daa-9daf-a042a69acac7","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e2e5ac4d-579a-4daa-9daf-a042a69acac7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52320","PortSpecifier":{"PortValue":52320}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442198,"nanos":352871013},"http":{"id":"e2e5ac4d-579a-4daa-9daf-a042a69acac7","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"e2e5ac4d-579a-4daa-9daf-a042a69acac7","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"e2e5ac4d-579a-4daa-9daf-a042a69acac7","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"e2e5ac4d-579a-4daa-9daf-a042a69acac7","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"e2e5ac4d-579a-4daa-9daf-a042a69acac7","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"e2e5ac4d-579a-4daa-9daf-a042a69acac7"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"e2e5ac4d-579a-4daa-9daf-a042a69acac7","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":352871013,"seconds":1783442198}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":52320},"address":"10.133.0.32:52320"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e2e5ac4d-579a-4daa-9daf-a042a69acac7","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e2e5ac4d-579a-4daa-9daf-a042a69acac7","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e2e5ac4d-579a-4daa-9daf-a042a69acac7","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e2e5ac4d-579a-4daa-9daf-a042a69acac7","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:maas-admin:tester-admin-user"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"e2e5ac4d-579a-4daa-9daf-a042a69acac7","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e2e5ac4d-579a-4daa-9daf-a042a69acac7","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:maas-admin\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e2e5ac4d-579a-4daa-9daf-a042a69acac7","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"info","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e2e5ac4d-579a-4daa-9daf-a042a69acac7","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e2e5ac4d-579a-4daa-9daf-a042a69acac7","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a54c0a02-f945-4079-be56-f6589c4b2a2a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52336","PortSpecifier":{"PortValue":52336}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"a54c0a02-f945-4079-be56-f6589c4b2a2a","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a54c0a02-f945-4079-be56-f6589c4b2a2a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52336","PortSpecifier":{"PortValue":52336}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442198,"nanos":391578330},"http":{"id":"a54c0a02-f945-4079-be56-f6589c4b2a2a","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"a54c0a02-f945-4079-be56-f6589c4b2a2a","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a54c0a02-f945-4079-be56-f6589c4b2a2a","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a54c0a02-f945-4079-be56-f6589c4b2a2a","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"a54c0a02-f945-4079-be56-f6589c4b2a2a","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"a54c0a02-f945-4079-be56-f6589c4b2a2a"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"a54c0a02-f945-4079-be56-f6589c4b2a2a","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":391578330,"seconds":1783442198}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":52336},"address":"10.133.0.32:52336"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a54c0a02-f945-4079-be56-f6589c4b2a2a","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a54c0a02-f945-4079-be56-f6589c4b2a2a","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a54c0a02-f945-4079-be56-f6589c4b2a2a","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a54c0a02-f945-4079-be56-f6589c4b2a2a","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:maas-admin:tester-admin-user"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"a54c0a02-f945-4079-be56-f6589c4b2a2a","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a54c0a02-f945-4079-be56-f6589c4b2a2a","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a54c0a02-f945-4079-be56-f6589c4b2a2a","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:maas-admin\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a54c0a02-f945-4079-be56-f6589c4b2a2a","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a54c0a02-f945-4079-be56-f6589c4b2a2a","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e1e904a7-0415-4fe3-8f96-3ef795d10977","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52344","PortSpecifier":{"PortValue":52344}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"e1e904a7-0415-4fe3-8f96-3ef795d10977","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e1e904a7-0415-4fe3-8f96-3ef795d10977","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52344","PortSpecifier":{"PortValue":52344}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442198,"nanos":404406618},"http":{"id":"e1e904a7-0415-4fe3-8f96-3ef795d10977","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"e1e904a7-0415-4fe3-8f96-3ef795d10977","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"e1e904a7-0415-4fe3-8f96-3ef795d10977","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"e1e904a7-0415-4fe3-8f96-3ef795d10977","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"e1e904a7-0415-4fe3-8f96-3ef795d10977","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"e1e904a7-0415-4fe3-8f96-3ef795d10977"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"e1e904a7-0415-4fe3-8f96-3ef795d10977","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":404406618,"seconds":1783442198}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":52344},"address":"10.133.0.32:52344"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e1e904a7-0415-4fe3-8f96-3ef795d10977","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e1e904a7-0415-4fe3-8f96-3ef795d10977","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e1e904a7-0415-4fe3-8f96-3ef795d10977","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"e1e904a7-0415-4fe3-8f96-3ef795d10977","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e1e904a7-0415-4fe3-8f96-3ef795d10977","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e1e904a7-0415-4fe3-8f96-3ef795d10977","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:maas-admin:tester-admin-user"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e1e904a7-0415-4fe3-8f96-3ef795d10977","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:maas-admin\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e1e904a7-0415-4fe3-8f96-3ef795d10977","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e1e904a7-0415-4fe3-8f96-3ef795d10977","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"74ade74a-304c-4af9-b0db-278bc58855d3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52350","PortSpecifier":{"PortValue":52350}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"74ade74a-304c-4af9-b0db-278bc58855d3","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"74ade74a-304c-4af9-b0db-278bc58855d3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52350","PortSpecifier":{"PortValue":52350}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442198,"nanos":416593706},"http":{"id":"74ade74a-304c-4af9-b0db-278bc58855d3","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"74ade74a-304c-4af9-b0db-278bc58855d3","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"74ade74a-304c-4af9-b0db-278bc58855d3","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"74ade74a-304c-4af9-b0db-278bc58855d3","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"74ade74a-304c-4af9-b0db-278bc58855d3","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"74ade74a-304c-4af9-b0db-278bc58855d3"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"74ade74a-304c-4af9-b0db-278bc58855d3","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":416593706,"seconds":1783442198}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":52350},"address":"10.133.0.32:52350"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"74ade74a-304c-4af9-b0db-278bc58855d3","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"74ade74a-304c-4af9-b0db-278bc58855d3","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"74ade74a-304c-4af9-b0db-278bc58855d3","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"74ade74a-304c-4af9-b0db-278bc58855d3","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"74ade74a-304c-4af9-b0db-278bc58855d3","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:maas-admin:tester-admin-user"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"74ade74a-304c-4af9-b0db-278bc58855d3","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"74ade74a-304c-4af9-b0db-278bc58855d3","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:maas-admin\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"74ade74a-304c-4af9-b0db-278bc58855d3","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"74ade74a-304c-4af9-b0db-278bc58855d3","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"cfbd5a55-b5fe-4ee4-b17f-a1f4865b88f3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52358","PortSpecifier":{"PortValue":52358}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"cfbd5a55-b5fe-4ee4-b17f-a1f4865b88f3","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"cfbd5a55-b5fe-4ee4-b17f-a1f4865b88f3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52358","PortSpecifier":{"PortValue":52358}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442198,"nanos":429304059},"http":{"id":"cfbd5a55-b5fe-4ee4-b17f-a1f4865b88f3","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"cfbd5a55-b5fe-4ee4-b17f-a1f4865b88f3","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"cfbd5a55-b5fe-4ee4-b17f-a1f4865b88f3","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"cfbd5a55-b5fe-4ee4-b17f-a1f4865b88f3","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"cfbd5a55-b5fe-4ee4-b17f-a1f4865b88f3","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"cfbd5a55-b5fe-4ee4-b17f-a1f4865b88f3"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"cfbd5a55-b5fe-4ee4-b17f-a1f4865b88f3","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":429304059,"seconds":1783442198}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":52358},"address":"10.133.0.32:52358"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cfbd5a55-b5fe-4ee4-b17f-a1f4865b88f3","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cfbd5a55-b5fe-4ee4-b17f-a1f4865b88f3","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cfbd5a55-b5fe-4ee4-b17f-a1f4865b88f3","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"cfbd5a55-b5fe-4ee4-b17f-a1f4865b88f3","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cfbd5a55-b5fe-4ee4-b17f-a1f4865b88f3","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:maas-admin:tester-admin-user"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cfbd5a55-b5fe-4ee4-b17f-a1f4865b88f3","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cfbd5a55-b5fe-4ee4-b17f-a1f4865b88f3","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:maas-admin\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"cfbd5a55-b5fe-4ee4-b17f-a1f4865b88f3","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"cfbd5a55-b5fe-4ee4-b17f-a1f4865b88f3","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f9c49355-13e7-41ef-a5d8-495d443b2c38","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52364","PortSpecifier":{"PortValue":52364}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"f9c49355-13e7-41ef-a5d8-495d443b2c38","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f9c49355-13e7-41ef-a5d8-495d443b2c38","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52364","PortSpecifier":{"PortValue":52364}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442198,"nanos":442738414},"http":{"id":"f9c49355-13e7-41ef-a5d8-495d443b2c38","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"f9c49355-13e7-41ef-a5d8-495d443b2c38","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"f9c49355-13e7-41ef-a5d8-495d443b2c38","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"f9c49355-13e7-41ef-a5d8-495d443b2c38","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"f9c49355-13e7-41ef-a5d8-495d443b2c38","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"f9c49355-13e7-41ef-a5d8-495d443b2c38"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"f9c49355-13e7-41ef-a5d8-495d443b2c38","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":442738414,"seconds":1783442198}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":52364},"address":"10.133.0.32:52364"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f9c49355-13e7-41ef-a5d8-495d443b2c38","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f9c49355-13e7-41ef-a5d8-495d443b2c38","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f9c49355-13e7-41ef-a5d8-495d443b2c38","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"f9c49355-13e7-41ef-a5d8-495d443b2c38","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f9c49355-13e7-41ef-a5d8-495d443b2c38","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:maas-admin:tester-admin-user"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f9c49355-13e7-41ef-a5d8-495d443b2c38","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f9c49355-13e7-41ef-a5d8-495d443b2c38","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:maas-admin\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f9c49355-13e7-41ef-a5d8-495d443b2c38","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f9c49355-13e7-41ef-a5d8-495d443b2c38","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0cb28e0a-d5a1-443a-b79e-a25b307ced8b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52368","PortSpecifier":{"PortValue":52368}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"0cb28e0a-d5a1-443a-b79e-a25b307ced8b","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0cb28e0a-d5a1-443a-b79e-a25b307ced8b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52368","PortSpecifier":{"PortValue":52368}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442198,"nanos":455579335},"http":{"id":"0cb28e0a-d5a1-443a-b79e-a25b307ced8b","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"0cb28e0a-d5a1-443a-b79e-a25b307ced8b","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"0cb28e0a-d5a1-443a-b79e-a25b307ced8b","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"0cb28e0a-d5a1-443a-b79e-a25b307ced8b","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"0cb28e0a-d5a1-443a-b79e-a25b307ced8b","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"0cb28e0a-d5a1-443a-b79e-a25b307ced8b"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"0cb28e0a-d5a1-443a-b79e-a25b307ced8b","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":455579335,"seconds":1783442198}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":52368},"address":"10.133.0.32:52368"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0cb28e0a-d5a1-443a-b79e-a25b307ced8b","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0cb28e0a-d5a1-443a-b79e-a25b307ced8b","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0cb28e0a-d5a1-443a-b79e-a25b307ced8b","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"0cb28e0a-d5a1-443a-b79e-a25b307ced8b","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0cb28e0a-d5a1-443a-b79e-a25b307ced8b","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:maas-admin:tester-admin-user"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0cb28e0a-d5a1-443a-b79e-a25b307ced8b","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0cb28e0a-d5a1-443a-b79e-a25b307ced8b","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:maas-admin\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0cb28e0a-d5a1-443a-b79e-a25b307ced8b","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0cb28e0a-d5a1-443a-b79e-a25b307ced8b","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"43bc96e9-bd69-4a70-9044-168f399e57f0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52378","PortSpecifier":{"PortValue":52378}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"43bc96e9-bd69-4a70-9044-168f399e57f0","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"43bc96e9-bd69-4a70-9044-168f399e57f0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52378","PortSpecifier":{"PortValue":52378}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442198,"nanos":491165991},"http":{"id":"43bc96e9-bd69-4a70-9044-168f399e57f0","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"43bc96e9-bd69-4a70-9044-168f399e57f0","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"43bc96e9-bd69-4a70-9044-168f399e57f0","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"43bc96e9-bd69-4a70-9044-168f399e57f0","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"43bc96e9-bd69-4a70-9044-168f399e57f0","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"43bc96e9-bd69-4a70-9044-168f399e57f0"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"43bc96e9-bd69-4a70-9044-168f399e57f0","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":491165991,"seconds":1783442198}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":52378},"address":"10.133.0.32:52378"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"43bc96e9-bd69-4a70-9044-168f399e57f0","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"43bc96e9-bd69-4a70-9044-168f399e57f0","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"43bc96e9-bd69-4a70-9044-168f399e57f0","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"43bc96e9-bd69-4a70-9044-168f399e57f0","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"43bc96e9-bd69-4a70-9044-168f399e57f0","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:maas-admin:tester-admin-user"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"43bc96e9-bd69-4a70-9044-168f399e57f0","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"43bc96e9-bd69-4a70-9044-168f399e57f0","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:maas-admin\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"43bc96e9-bd69-4a70-9044-168f399e57f0","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"43bc96e9-bd69-4a70-9044-168f399e57f0","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d45d71d3-6d36-45f1-bec1-32994955ba14","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52392","PortSpecifier":{"PortValue":52392}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"d45d71d3-6d36-45f1-bec1-32994955ba14","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d45d71d3-6d36-45f1-bec1-32994955ba14","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52392","PortSpecifier":{"PortValue":52392}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442198,"nanos":504108743},"http":{"id":"d45d71d3-6d36-45f1-bec1-32994955ba14","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"d45d71d3-6d36-45f1-bec1-32994955ba14","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"d45d71d3-6d36-45f1-bec1-32994955ba14","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"d45d71d3-6d36-45f1-bec1-32994955ba14","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"d45d71d3-6d36-45f1-bec1-32994955ba14","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"d45d71d3-6d36-45f1-bec1-32994955ba14"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"d45d71d3-6d36-45f1-bec1-32994955ba14","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":504108743,"seconds":1783442198}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":52392},"address":"10.133.0.32:52392"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d45d71d3-6d36-45f1-bec1-32994955ba14","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d45d71d3-6d36-45f1-bec1-32994955ba14","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d45d71d3-6d36-45f1-bec1-32994955ba14","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d45d71d3-6d36-45f1-bec1-32994955ba14","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"d45d71d3-6d36-45f1-bec1-32994955ba14","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d45d71d3-6d36-45f1-bec1-32994955ba14","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:maas-admin\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d45d71d3-6d36-45f1-bec1-32994955ba14","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:maas-admin:tester-admin-user"}
{"level":"info","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d45d71d3-6d36-45f1-bec1-32994955ba14","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d45d71d3-6d36-45f1-bec1-32994955ba14","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"aedb77d8-f13b-40d3-ac24-f59848b2de2e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52394","PortSpecifier":{"PortValue":52394}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"aedb77d8-f13b-40d3-ac24-f59848b2de2e","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"aedb77d8-f13b-40d3-ac24-f59848b2de2e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52394","PortSpecifier":{"PortValue":52394}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442198,"nanos":517071669},"http":{"id":"aedb77d8-f13b-40d3-ac24-f59848b2de2e","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"aedb77d8-f13b-40d3-ac24-f59848b2de2e","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"aedb77d8-f13b-40d3-ac24-f59848b2de2e","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"aedb77d8-f13b-40d3-ac24-f59848b2de2e","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"aedb77d8-f13b-40d3-ac24-f59848b2de2e","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"aedb77d8-f13b-40d3-ac24-f59848b2de2e"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"aedb77d8-f13b-40d3-ac24-f59848b2de2e","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":517071669,"seconds":1783442198}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":52394},"address":"10.133.0.32:52394"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"aedb77d8-f13b-40d3-ac24-f59848b2de2e","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"aedb77d8-f13b-40d3-ac24-f59848b2de2e","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"aedb77d8-f13b-40d3-ac24-f59848b2de2e","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"aedb77d8-f13b-40d3-ac24-f59848b2de2e","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"aedb77d8-f13b-40d3-ac24-f59848b2de2e","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:maas-admin:tester-admin-user"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"aedb77d8-f13b-40d3-ac24-f59848b2de2e","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"aedb77d8-f13b-40d3-ac24-f59848b2de2e","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:maas-admin\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"aedb77d8-f13b-40d3-ac24-f59848b2de2e","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"aedb77d8-f13b-40d3-ac24-f59848b2de2e","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"65cb3a0e-bfc1-4682-a89d-bc4effcd410d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52396","PortSpecifier":{"PortValue":52396}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"65cb3a0e-bfc1-4682-a89d-bc4effcd410d","method":"GET","path":"/v1/models","host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"65cb3a0e-bfc1-4682-a89d-bc4effcd410d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:52396","PortSpecifier":{"PortValue":52396}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442198,"nanos":530240986},"http":{"id":"65cb3a0e-bfc1-4682-a89d-bc4effcd410d","method":"GET","headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"65cb3a0e-bfc1-4682-a89d-bc4effcd410d","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"65cb3a0e-bfc1-4682-a89d-bc4effcd410d","config":"apiKeyValidation","method":"POST","url":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl\"}"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"65cb3a0e-bfc1-4682-a89d-bc4effcd410d","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"keyId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","keyName":"validate-test-1783442183","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"17f02a1d-801f-4933-abe2-92a9a3f1536e","username":"system:serviceaccount:maas-admin:tester-admin-user","valid":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"65cb3a0e-bfc1-4682-a89d-bc4effcd410d","input":{"auth":{"identity":"Bearer **** sk-oai-1JFigbByfLbM7FHj1_MbNWdCeuigDSCCyvx67vy4ADXfuII2SrLMp160dHSRl","user-agent":"Go-http-client/1.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.133.0.32","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"10.133.0.32","x-forwarded-proto":"https","x-maas-subscription":"simulator-subscription","x-request-id":"65cb3a0e-bfc1-4682-a89d-bc4effcd410d"},"host":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local","id":"65cb3a0e-bfc1-4682-a89d-bc4effcd410d","method":"GET","path":"/v1/models","protocol":"HTTP/1.1","scheme":"https"},"time":{"nanos":530240986,"seconds":1783442198}},"source":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":52396},"address":"10.133.0.32:52396"}}}}},"destination":{"address":"10.132.0.34:443","port":443},"metadata":{},"request":{"context_extensions":{"host":"c9f2cdb36f800bc8ef8831e6117ec4c6cc521d8cd63b718b7906225d0f25e59f"},"headers":{":authority":"maas-default-gateway-openshift-default.openshift-ingress.svc.cluster.local",":method":"GET",":path":"/v1/models",":scheme":"https","accept-encoding":"gzip","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"65cb3a0e-bfc1-4682-a89d-bc4effcd410d","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"65cb3a0e-bfc1-4682-a89d-bc4effcd410d","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"65cb3a0e-bfc1-4682-a89d-bc4effcd410d","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"65cb3a0e-bfc1-4682-a89d-bc4effcd410d","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:maas-admin:tester-admin-user"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"65cb3a0e-bfc1-4682-a89d-bc4effcd410d","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: subscription-info"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"65cb3a0e-bfc1-4682-a89d-bc4effcd410d","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"65cb3a0e-bfc1-4682-a89d-bc4effcd410d","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:maas-admin\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"65cb3a0e-bfc1-4682-a89d-bc4effcd410d","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"65cb3a0e-bfc1-4682-a89d-bc4effcd410d","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c2b29b42-7487-4acc-901b-d822694f0679","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:34022","PortSpecifier":{"PortValue":34022}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"c2b29b42-7487-4acc-901b-d822694f0679","method":"DELETE","path":"/maas-api/v1/api-keys/17f02a1d-801f-4933-abe2-92a9a3f1536e","host":"maas.apps.f8d243c7-e544-422f-be6e-b8b1f68b510f.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c2b29b42-7487-4acc-901b-d822694f0679","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.7:34022","PortSpecifier":{"PortValue":34022}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.34:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783442198,"nanos":868764154},"http":{"id":"c2b29b42-7487-4acc-901b-d822694f0679","method":"DELETE","headers":{":authority":"maas.apps.f8d243c7-e544-422f-be6e-b8b1f68b510f.prod.konfluxeaas.com",":method":"DELETE",":path":"/maas-api/v1/api-keys/17f02a1d-801f-4933-abe2-92a9a3f1536e",":scheme":"https","accept":"*/*","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"cannot validate identity","request id":"c2b29b42-7487-4acc-901b-d822694f0679","config":{"Name":"oidc-identities","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":null,"Plain":null,"Noop":null,"ExtendedProperties":[]},"reason":"failed to verify signature: failed to verify id token signature"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"c2b29b42-7487-4acc-901b-d822694f0679","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"c2b29b42-7487-4acc-901b-d822694f0679","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:maas-admin:tester-admin-user","uid":"c89d94c5-9627-401b-83f9-14508c428d40","groups":["system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=93247832-6568-4016-938d-8a7ceac3a6f9"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/b8b1f68b510f"]}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"c2b29b42-7487-4acc-901b-d822694f0679","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/b8b1f68b510f"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=93247832-6568-4016-938d-8a7ceac3a6f9"]},"groups":["system:serviceaccounts","system:serviceaccounts:maas-admin","system:authenticated"],"uid":"c89d94c5-9627-401b-83f9-14508c428d40","username":"system:serviceaccount:maas-admin:tester-admin-user"}}},"context":{"context_extensions":{"host":"4b78668c68e506f3e4245c5d1f1af6820d0987e90bac1b37e2a03d21cc7ed38d"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.34:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.f8d243c7-e544-422f-be6e-b8b1f68b510f.prod.konfluxeaas.com",":method":"DELETE",":path":"/maas-api/v1/api-keys/17f02a1d-801f-4933-abe2-92a9a3f1536e",":scheme":"https","accept":"*/*","authorization":"Bearer **** ****REDACTED_JWT****","forwarded":"for=52.71.36.72;host=maas.apps.f8d243c7-e544-422f-be6e-b8b1f68b510f.prod.konfluxeaas.com;proto=https","user-agent":"curl/7.76.1","x-envoy-decorator-operation":"maas-api.opendatahub.svc.cluster.local:8443/*","x-envoy-external-address":"10.132.0.7","x-envoy-peer-metadata":"ChoKCkNMVVNURVJfSUQSDBoKS3ViZXJuZXRlcwqLAQoGTEFCRUxTEoABKn4KSwofc2VydmljZS5pc3Rpby5pby9jYW5vbmljYWwtbmFtZRIoGiZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAovCiNzZXJ2aWNlLmlzdGlvLmlvL2Nhbm9uaWNhbC1yZXZpc2lvbhIIGgZsYXRlc3QKQAoETkFNRRI4GjZtYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdC01NjY1NGRjZjctamtiY2sKIAoJTkFNRVNQQUNFEhMaEW9wZW5zaGlmdC1pbmdyZXNzCnQKBU9XTkVSEmsaaWt1YmVybmV0ZXM6Ly9hcGlzL2FwcHMvdjEvbmFtZXNwYWNlcy9vcGVuc2hpZnQtaW5ncmVzcy9kZXBsb3ltZW50cy9tYWFzLWRlZmF1bHQtZ2F0ZXdheS1vcGVuc2hpZnQtZGVmYXVsdAo5Cg1XT1JLTE9BRF9OQU1FEigaJm1hYXMtZGVmYXVsdC1nYXRld2F5LW9wZW5zaGlmdC1kZWZhdWx0","x-envoy-peer-metadata-id":"router~10.132.0.34~maas-default-gateway-openshift-default-56654dcf7-jkbck.openshift-ingress~openshift-ingress.svc.cluster.local","x-forwarded-for":"52.71.36.72,10.132.0.7","x-forwarded-host":"maas.apps.f8d243c7-e544-422f-be6e-b8b1f68b510f.prod.konfluxeaas.com","x-forwarded-port":"443","x-forwarded-proto":"https","x-request-id":"c2b29b42-7487-4acc-901b-d822694f0679"},"host":"maas.apps.f8d243c7-e544-422f-be6e-b8b1f68b510f.prod.konfluxeaas.com","id":"c2b29b42-7487-4acc-901b-d822694f0679","method":"DELETE","path":"/maas-api/v1/api-keys/17f02a1d-801f-4933-abe2-92a9a3f1536e","protocol":"HTTP/1.1","scheme":"https","time":{"nanos":868764154,"seconds":1783442198},"url_path":"/maas-api/v1/api-keys/17f02a1d-801f-4933-abe2-92a9a3f1536e","user_agent":"curl/7.76.1"},"source":{"address":"10.132.0.7:34022","port":34022}}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c2b29b42-7487-4acc-901b-d822694f0679","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c2b29b42-7487-4acc-901b-d822694f0679","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c2b29b42-7487-4acc-901b-d822694f0679","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"c2b29b42-7487-4acc-901b-d822694f0679","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c2b29b42-7487-4acc-901b-d822694f0679","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:maas-admin:tester-admin-user"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c2b29b42-7487-4acc-901b-d822694f0679","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:maas-admin\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c2b29b42-7487-4acc-901b-d822694f0679","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T16:36:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c2b29b42-7487-4acc-901b-d822694f0679","authorized":true,"response":"OK"}