{"level":"debug","ts":"2026-07-09T15:35:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2029432bfc4997fa122e3818da16e0a49c98392c7664ff1311671649ba28fb1e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T15:35:47Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T15:35:47Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["2029432bfc4997fa122e3818da16e0a49c98392c7664ff1311671649ba28fb1e"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T15:35:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9cbfbe53ce2fd4a9b514c77832b2872c7b804af0ae596fc03b45723a152b7eda"}
{"level":"info","ts":"2026-07-09T15:35:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2029432bfc4997fa122e3818da16e0a49c98392c7664ff1311671649ba28fb1e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T15:35:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e555e8b920633f9e4449473cbb227183f87cea8ab777c3e2e34483afed38679a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T15:35:47Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T15:35:47Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T15:35:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e555e8b920633f9e4449473cbb227183f87cea8ab777c3e2e34483afed38679a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T15:35:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9cbfbe53ce2fd4a9b514c77832b2872c7b804af0ae596fc03b45723a152b7eda","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T15:35:47Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T15:35:47Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["9cbfbe53ce2fd4a9b514c77832b2872c7b804af0ae596fc03b45723a152b7eda"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T15:35:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2029432bfc4997fa122e3818da16e0a49c98392c7664ff1311671649ba28fb1e"}
{"level":"info","ts":"2026-07-09T15:35:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9cbfbe53ce2fd4a9b514c77832b2872c7b804af0ae596fc03b45723a152b7eda","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T15:35:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2029432bfc4997fa122e3818da16e0a49c98392c7664ff1311671649ba28fb1e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T15:35:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e555e8b920633f9e4449473cbb227183f87cea8ab777c3e2e34483afed38679a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T15:35:47Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T15:35:47Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T15:35:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e555e8b920633f9e4449473cbb227183f87cea8ab777c3e2e34483afed38679a"}
{"level":"info","ts":"2026-07-09T15:35:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e555e8b920633f9e4449473cbb227183f87cea8ab777c3e2e34483afed38679a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T15:35:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9cbfbe53ce2fd4a9b514c77832b2872c7b804af0ae596fc03b45723a152b7eda","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T15:35:47Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T15:35:47Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T15:35:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9cbfbe53ce2fd4a9b514c77832b2872c7b804af0ae596fc03b45723a152b7eda","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T15:35:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e555e8b920633f9e4449473cbb227183f87cea8ab777c3e2e34483afed38679a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T15:35:47Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T15:35:47Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["e555e8b920633f9e4449473cbb227183f87cea8ab777c3e2e34483afed38679a"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T15:35:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9cbfbe53ce2fd4a9b514c77832b2872c7b804af0ae596fc03b45723a152b7eda"}
{"level":"info","ts":"2026-07-09T15:35:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e555e8b920633f9e4449473cbb227183f87cea8ab777c3e2e34483afed38679a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T15:35:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9cbfbe53ce2fd4a9b514c77832b2872c7b804af0ae596fc03b45723a152b7eda","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T15:35:47Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T15:35:47Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["9cbfbe53ce2fd4a9b514c77832b2872c7b804af0ae596fc03b45723a152b7eda"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T15:35:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2029432bfc4997fa122e3818da16e0a49c98392c7664ff1311671649ba28fb1e"}
{"level":"info","ts":"2026-07-09T15:35:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9cbfbe53ce2fd4a9b514c77832b2872c7b804af0ae596fc03b45723a152b7eda","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T15:35:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e555e8b920633f9e4449473cbb227183f87cea8ab777c3e2e34483afed38679a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T15:35:47Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T15:35:47Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T15:35:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e555e8b920633f9e4449473cbb227183f87cea8ab777c3e2e34483afed38679a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T15:35:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9cbfbe53ce2fd4a9b514c77832b2872c7b804af0ae596fc03b45723a152b7eda","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T15:35:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e555e8b920633f9e4449473cbb227183f87cea8ab777c3e2e34483afed38679a","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T15:35:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e555e8b920633f9e4449473cbb227183f87cea8ab777c3e2e34483afed38679a"}
{"level":"debug","ts":"2026-07-09T15:35:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e555e8b920633f9e4449473cbb227183f87cea8ab777c3e2e34483afed38679a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T15:35:47Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T15:35:47Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["e555e8b920633f9e4449473cbb227183f87cea8ab777c3e2e34483afed38679a"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T15:35:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e555e8b920633f9e4449473cbb227183f87cea8ab777c3e2e34483afed38679a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T15:35:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e555e8b920633f9e4449473cbb227183f87cea8ab777c3e2e34483afed38679a","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T15:35:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9cbfbe53ce2fd4a9b514c77832b2872c7b804af0ae596fc03b45723a152b7eda"}
{"level":"info","ts":"2026-07-09T15:35:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e555e8b920633f9e4449473cbb227183f87cea8ab777c3e2e34483afed38679a"}
{"level":"debug","ts":"2026-07-09T15:36:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1e6fc99fe7cc8411a3c02a2fe5b0ad77d3837b94bc64b178dd8885e76757487a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T15:36:01Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T15:36:01Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T15:36:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1e6fc99fe7cc8411a3c02a2fe5b0ad77d3837b94bc64b178dd8885e76757487a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T15:36:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1e6fc99fe7cc8411a3c02a2fe5b0ad77d3837b94bc64b178dd8885e76757487a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T15:36:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1e6fc99fe7cc8411a3c02a2fe5b0ad77d3837b94bc64b178dd8885e76757487a","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T15:36:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1e6fc99fe7cc8411a3c02a2fe5b0ad77d3837b94bc64b178dd8885e76757487a"}
{"level":"debug","ts":"2026-07-09T15:36:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1e6fc99fe7cc8411a3c02a2fe5b0ad77d3837b94bc64b178dd8885e76757487a","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T15:36:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1e6fc99fe7cc8411a3c02a2fe5b0ad77d3837b94bc64b178dd8885e76757487a"}
{"level":"debug","ts":"2026-07-09T15:36:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1e6fc99fe7cc8411a3c02a2fe5b0ad77d3837b94bc64b178dd8885e76757487a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T15:36:01Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T15:36:01Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["1e6fc99fe7cc8411a3c02a2fe5b0ad77d3837b94bc64b178dd8885e76757487a"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T15:36:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1e6fc99fe7cc8411a3c02a2fe5b0ad77d3837b94bc64b178dd8885e76757487a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T15:36:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e555e8b920633f9e4449473cbb227183f87cea8ab777c3e2e34483afed38679a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T15:36:01Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T15:36:01Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T15:36:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e555e8b920633f9e4449473cbb227183f87cea8ab777c3e2e34483afed38679a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T15:36:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1e6fc99fe7cc8411a3c02a2fe5b0ad77d3837b94bc64b178dd8885e76757487a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T15:36:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e555e8b920633f9e4449473cbb227183f87cea8ab777c3e2e34483afed38679a","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T15:36:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e555e8b920633f9e4449473cbb227183f87cea8ab777c3e2e34483afed38679a"}
{"level":"debug","ts":"2026-07-09T15:36:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e555e8b920633f9e4449473cbb227183f87cea8ab777c3e2e34483afed38679a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T15:36:01Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T15:36:01Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["e555e8b920633f9e4449473cbb227183f87cea8ab777c3e2e34483afed38679a"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T15:36:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e555e8b920633f9e4449473cbb227183f87cea8ab777c3e2e34483afed38679a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T15:36:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e555e8b920633f9e4449473cbb227183f87cea8ab777c3e2e34483afed38679a","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T15:36:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1e6fc99fe7cc8411a3c02a2fe5b0ad77d3837b94bc64b178dd8885e76757487a"}
{"level":"debug","ts":"2026-07-09T15:36:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a6ae7d7572377d1195f819f319e9d3490e45b035fcd34cbced5dd0b544d017e9","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T15:36:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e555e8b920633f9e4449473cbb227183f87cea8ab777c3e2e34483afed38679a"}
{"level":"info","ts":"2026-07-09T15:36:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a6ae7d7572377d1195f819f319e9d3490e45b035fcd34cbced5dd0b544d017e9"}
{"level":"debug","ts":"2026-07-09T15:36:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3bf36d6fa9c36237450129e3a000b1e89a39a305ce2d0f06b345196ab160711e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T15:36:01Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T15:36:01Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T15:36:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3bf36d6fa9c36237450129e3a000b1e89a39a305ce2d0f06b345196ab160711e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T15:36:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3bf36d6fa9c36237450129e3a000b1e89a39a305ce2d0f06b345196ab160711e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T15:36:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3bf36d6fa9c36237450129e3a000b1e89a39a305ce2d0f06b345196ab160711e","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T15:36:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3bf36d6fa9c36237450129e3a000b1e89a39a305ce2d0f06b345196ab160711e"}
{"level":"debug","ts":"2026-07-09T15:36:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3bf36d6fa9c36237450129e3a000b1e89a39a305ce2d0f06b345196ab160711e","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T15:36:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3bf36d6fa9c36237450129e3a000b1e89a39a305ce2d0f06b345196ab160711e"}
{"level":"debug","ts":"2026-07-09T15:36:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3bf36d6fa9c36237450129e3a000b1e89a39a305ce2d0f06b345196ab160711e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T15:36:01Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T15:36:01Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3bf36d6fa9c36237450129e3a000b1e89a39a305ce2d0f06b345196ab160711e"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T15:36:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3bf36d6fa9c36237450129e3a000b1e89a39a305ce2d0f06b345196ab160711e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T15:36:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3bf36d6fa9c36237450129e3a000b1e89a39a305ce2d0f06b345196ab160711e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T15:36:01Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T15:36:01Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T15:36:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3bf36d6fa9c36237450129e3a000b1e89a39a305ce2d0f06b345196ab160711e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T15:36:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d5504fe62b8e55ebf23f874bf846c88a4080911486ee2076f2a0ebc2d8e7e6c5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T15:36:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3bf36d6fa9c36237450129e3a000b1e89a39a305ce2d0f06b345196ab160711e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T15:36:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3bf36d6fa9c36237450129e3a000b1e89a39a305ce2d0f06b345196ab160711e","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T15:36:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3bf36d6fa9c36237450129e3a000b1e89a39a305ce2d0f06b345196ab160711e"}
{"level":"debug","ts":"2026-07-09T15:36:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3bf36d6fa9c36237450129e3a000b1e89a39a305ce2d0f06b345196ab160711e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T15:36:01Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T15:36:01Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3bf36d6fa9c36237450129e3a000b1e89a39a305ce2d0f06b345196ab160711e"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T15:36:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d5504fe62b8e55ebf23f874bf846c88a4080911486ee2076f2a0ebc2d8e7e6c5"}
{"level":"info","ts":"2026-07-09T15:36:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3bf36d6fa9c36237450129e3a000b1e89a39a305ce2d0f06b345196ab160711e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T15:36:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3bf36d6fa9c36237450129e3a000b1e89a39a305ce2d0f06b345196ab160711e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T15:36:01Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T15:36:01Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T15:36:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3bf36d6fa9c36237450129e3a000b1e89a39a305ce2d0f06b345196ab160711e"}
{"level":"info","ts":"2026-07-09T15:36:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3bf36d6fa9c36237450129e3a000b1e89a39a305ce2d0f06b345196ab160711e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T15:36:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3bf36d6fa9c36237450129e3a000b1e89a39a305ce2d0f06b345196ab160711e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T15:36:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3bf36d6fa9c36237450129e3a000b1e89a39a305ce2d0f06b345196ab160711e","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T15:36:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3bf36d6fa9c36237450129e3a000b1e89a39a305ce2d0f06b345196ab160711e"}
{"level":"debug","ts":"2026-07-09T15:36:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3bf36d6fa9c36237450129e3a000b1e89a39a305ce2d0f06b345196ab160711e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T15:36:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"dfea2a47467717d4d4b0a26e5cec25323b54ad1ee1aa724dd7350b62f3507460","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T15:36:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3bf36d6fa9c36237450129e3a000b1e89a39a305ce2d0f06b345196ab160711e"}
{"level":"info","ts":"2026-07-09T15:36:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/dfea2a47467717d4d4b0a26e5cec25323b54ad1ee1aa724dd7350b62f3507460"}
{"level":"debug","ts":"2026-07-09T15:36:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3bf36d6fa9c36237450129e3a000b1e89a39a305ce2d0f06b345196ab160711e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T15:36:01Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T15:36:01Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3bf36d6fa9c36237450129e3a000b1e89a39a305ce2d0f06b345196ab160711e"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T15:36:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3bf36d6fa9c36237450129e3a000b1e89a39a305ce2d0f06b345196ab160711e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T15:36:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3bf36d6fa9c36237450129e3a000b1e89a39a305ce2d0f06b345196ab160711e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T15:36:01Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T15:36:01Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T15:36:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3bf36d6fa9c36237450129e3a000b1e89a39a305ce2d0f06b345196ab160711e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T15:36:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3bf36d6fa9c36237450129e3a000b1e89a39a305ce2d0f06b345196ab160711e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T15:36:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3bf36d6fa9c36237450129e3a000b1e89a39a305ce2d0f06b345196ab160711e","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T15:36:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3bf36d6fa9c36237450129e3a000b1e89a39a305ce2d0f06b345196ab160711e"}
{"level":"debug","ts":"2026-07-09T15:36:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3bf36d6fa9c36237450129e3a000b1e89a39a305ce2d0f06b345196ab160711e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T15:36:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"795fdb83fea48c1d43e15ceaedfbb230725adb7e498e6d8cf0f70c1cc216b1c9","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T15:36:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3bf36d6fa9c36237450129e3a000b1e89a39a305ce2d0f06b345196ab160711e"}
{"level":"debug","ts":"2026-07-09T15:36:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"14304f2900ac8905c677ee56cab3ef81b96f90e60071647e8f874f4b5ea85fe8","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T15:36:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/795fdb83fea48c1d43e15ceaedfbb230725adb7e498e6d8cf0f70c1cc216b1c9"}
{"level":"debug","ts":"2026-07-09T15:36:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3bf36d6fa9c36237450129e3a000b1e89a39a305ce2d0f06b345196ab160711e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T15:36:01Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T15:36:01Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3bf36d6fa9c36237450129e3a000b1e89a39a305ce2d0f06b345196ab160711e"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T15:36:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/14304f2900ac8905c677ee56cab3ef81b96f90e60071647e8f874f4b5ea85fe8"}
{"level":"info","ts":"2026-07-09T15:36:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3bf36d6fa9c36237450129e3a000b1e89a39a305ce2d0f06b345196ab160711e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T15:36:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3bf36d6fa9c36237450129e3a000b1e89a39a305ce2d0f06b345196ab160711e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T15:36:01Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T15:36:01Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T15:36:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3bf36d6fa9c36237450129e3a000b1e89a39a305ce2d0f06b345196ab160711e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T15:36:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3bf36d6fa9c36237450129e3a000b1e89a39a305ce2d0f06b345196ab160711e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T15:36:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3bf36d6fa9c36237450129e3a000b1e89a39a305ce2d0f06b345196ab160711e","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T15:36:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3bf36d6fa9c36237450129e3a000b1e89a39a305ce2d0f06b345196ab160711e"}
{"level":"debug","ts":"2026-07-09T15:36:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3bf36d6fa9c36237450129e3a000b1e89a39a305ce2d0f06b345196ab160711e","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T15:36:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3bf36d6fa9c36237450129e3a000b1e89a39a305ce2d0f06b345196ab160711e"}
{"level":"debug","ts":"2026-07-09T15:36:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"96c117274f08d9e7e3ba0030a47aaea5d2c001b650f564acc423b44a972edc71","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T15:36:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4c400f837bcabb582b18d87f3de003fbfe150bec7a6642d0f3923289f3384eea","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T15:36:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/96c117274f08d9e7e3ba0030a47aaea5d2c001b650f564acc423b44a972edc71"}
{"level":"debug","ts":"2026-07-09T15:36:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3bf36d6fa9c36237450129e3a000b1e89a39a305ce2d0f06b345196ab160711e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T15:36:01Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T15:36:01Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3bf36d6fa9c36237450129e3a000b1e89a39a305ce2d0f06b345196ab160711e"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T15:36:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4c400f837bcabb582b18d87f3de003fbfe150bec7a6642d0f3923289f3384eea"}
{"level":"info","ts":"2026-07-09T15:36:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3bf36d6fa9c36237450129e3a000b1e89a39a305ce2d0f06b345196ab160711e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T15:36:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3bf36d6fa9c36237450129e3a000b1e89a39a305ce2d0f06b345196ab160711e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T15:36:01Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T15:36:01Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T15:36:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3bf36d6fa9c36237450129e3a000b1e89a39a305ce2d0f06b345196ab160711e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T15:36:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3bf36d6fa9c36237450129e3a000b1e89a39a305ce2d0f06b345196ab160711e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T15:36:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3bf36d6fa9c36237450129e3a000b1e89a39a305ce2d0f06b345196ab160711e","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T15:36:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3bf36d6fa9c36237450129e3a000b1e89a39a305ce2d0f06b345196ab160711e"}
{"level":"debug","ts":"2026-07-09T15:36:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3bf36d6fa9c36237450129e3a000b1e89a39a305ce2d0f06b345196ab160711e","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T15:36:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3bf36d6fa9c36237450129e3a000b1e89a39a305ce2d0f06b345196ab160711e"}
{"level":"debug","ts":"2026-07-09T15:36:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"fd2ef392fe6b93842a2ebd2a981c8252d36c7abf2a53385d8d78395500a95476","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T15:36:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f3a15a315e24d8d6624058b1341c21911264514849990c03a1506b63318027e6","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T15:36:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/fd2ef392fe6b93842a2ebd2a981c8252d36c7abf2a53385d8d78395500a95476"}
{"level":"debug","ts":"2026-07-09T15:36:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3bf36d6fa9c36237450129e3a000b1e89a39a305ce2d0f06b345196ab160711e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T15:36:02Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T15:36:02Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3bf36d6fa9c36237450129e3a000b1e89a39a305ce2d0f06b345196ab160711e"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T15:36:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f3a15a315e24d8d6624058b1341c21911264514849990c03a1506b63318027e6"}
{"level":"info","ts":"2026-07-09T15:36:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3bf36d6fa9c36237450129e3a000b1e89a39a305ce2d0f06b345196ab160711e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T15:36:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2ed220395ed279bad022bc5d8791c26dc8fa8bd57b7ab11c056ead3de2606e98","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-09T15:36:02Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-09T15:36:02Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T15:36:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2ed220395ed279bad022bc5d8791c26dc8fa8bd57b7ab11c056ead3de2606e98","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T15:36:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3bf36d6fa9c36237450129e3a000b1e89a39a305ce2d0f06b345196ab160711e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T15:36:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7da18c45296d4e760ec3628f616fcb9bc835030fcfe46372b9bba4b6e4209bd6","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T15:36:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2ed220395ed279bad022bc5d8791c26dc8fa8bd57b7ab11c056ead3de2606e98"}
{"level":"debug","ts":"2026-07-09T15:36:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2ed220395ed279bad022bc5d8791c26dc8fa8bd57b7ab11c056ead3de2606e98","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T15:36:02Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T15:36:02Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["2ed220395ed279bad022bc5d8791c26dc8fa8bd57b7ab11c056ead3de2606e98"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T15:36:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2ed220395ed279bad022bc5d8791c26dc8fa8bd57b7ab11c056ead3de2606e98","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T15:36:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2ed220395ed279bad022bc5d8791c26dc8fa8bd57b7ab11c056ead3de2606e98","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-09T15:36:02Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-09T15:36:02Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["2ed220395ed279bad022bc5d8791c26dc8fa8bd57b7ab11c056ead3de2606e98"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-09T15:36:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3bf36d6fa9c36237450129e3a000b1e89a39a305ce2d0f06b345196ab160711e"}
{"level":"error","ts":"2026-07-09T15:36:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"2ed220395ed279bad022bc5d8791c26dc8fa8bd57b7ab11c056ead3de2606e98","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"2ed220395ed279bad022bc5d8791c26dc8fa8bd57b7ab11c056ead3de2606e98\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-09T15:36:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2ed220395ed279bad022bc5d8791c26dc8fa8bd57b7ab11c056ead3de2606e98","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T15:36:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2ed220395ed279bad022bc5d8791c26dc8fa8bd57b7ab11c056ead3de2606e98","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T15:36:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5d7d657d71b0fc9cb2f5917b3127cb6115d20b7c1a197b432bbf6b75ae13a5c4","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T15:36:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7da18c45296d4e760ec3628f616fcb9bc835030fcfe46372b9bba4b6e4209bd6"}
{"level":"debug","ts":"2026-07-09T15:36:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7fb8f330cf2e87575566162355685096b3459bc5bea0d3b52e020c3b68908e8f","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T15:36:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2ed220395ed279bad022bc5d8791c26dc8fa8bd57b7ab11c056ead3de2606e98"}
{"level":"debug","ts":"2026-07-09T15:36:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4c300c052ac4fd6938cef110c4213f130c42defb7745fcf982a32c044d791fa6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T15:36:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7fef3087cc5da3715f76063c79d44c91c20a31616698f1ee16d92c1187beb2b2","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T15:36:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5d7d657d71b0fc9cb2f5917b3127cb6115d20b7c1a197b432bbf6b75ae13a5c4"}
{"level":"info","ts":"2026-07-09T15:36:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7fb8f330cf2e87575566162355685096b3459bc5bea0d3b52e020c3b68908e8f"}
{"level":"info","ts":"2026-07-09T15:36:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4c300c052ac4fd6938cef110c4213f130c42defb7745fcf982a32c044d791fa6"}
{"level":"debug","ts":"2026-07-09T15:36:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2029432bfc4997fa122e3818da16e0a49c98392c7664ff1311671649ba28fb1e","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T15:36:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7fef3087cc5da3715f76063c79d44c91c20a31616698f1ee16d92c1187beb2b2"}
{"level":"debug","ts":"2026-07-09T15:36:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"12b645b9aad06e871b008c5fdf114cdb55b9d68aa58351eaa70aefd4c4586a11","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-09T15:36:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9cbfbe53ce2fd4a9b514c77832b2872c7b804af0ae596fc03b45723a152b7eda","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T15:36:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2029432bfc4997fa122e3818da16e0a49c98392c7664ff1311671649ba28fb1e"}
{"level":"debug","ts":"2026-07-09T15:36:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b26f03d1657cfdc3d80c3577d9920e2d2fdeb8be3c44a9e6a628daa932ed55df","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T15:36:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/12b645b9aad06e871b008c5fdf114cdb55b9d68aa58351eaa70aefd4c4586a11"}
{"level":"debug","ts":"2026-07-09T15:36:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4afb2c3c2feb41dff707127a88ccdc366ca6f3fc55b3988b1ba567dc5ce5313a","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T15:36:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9cbfbe53ce2fd4a9b514c77832b2872c7b804af0ae596fc03b45723a152b7eda"}
{"level":"debug","ts":"2026-07-09T15:36:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"fc396a42c65aecc7f96a92535c05dee18fa5491f77b5ee3175b02c22f9814839","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-09T15:36:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b26f03d1657cfdc3d80c3577d9920e2d2fdeb8be3c44a9e6a628daa932ed55df"}
{"level":"info","ts":"2026-07-09T15:36:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4afb2c3c2feb41dff707127a88ccdc366ca6f3fc55b3988b1ba567dc5ce5313a"}
{"level":"info","ts":"2026-07-09T15:36:02Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/fc396a42c65aecc7f96a92535c05dee18fa5491f77b5ee3175b02c22f9814839"}
{"level":"info","ts":"2026-07-09T15:36:04Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"bdd59776-5086-4a8f-82ad-0629e6fa9fab","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.8:39634","PortSpecifier":{"PortValue":39634}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.37:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"bdd59776-5086-4a8f-82ad-0629e6fa9fab","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-bf561e.apps.816cbb1a-c3a9-4178-8da2-86e43f1f7dee.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T15:36:04Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"bdd59776-5086-4a8f-82ad-0629e6fa9fab","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.8:39634","PortSpecifier":{"PortValue":39634}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.37:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783611364,"nanos":561922765},"http":{"id":"bdd59776-5086-4a8f-82ad-0629e6fa9fab","method":"POST","headers":{":authority":"e2e-shared-a-bf561e.apps.816cbb1a-c3a9-4178-8da2-86e43f1f7dee.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T15:36:04Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"bdd59776-5086-4a8f-82ad-0629e6fa9fab","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-09T15:36:04Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"bdd59776-5086-4a8f-82ad-0629e6fa9fab","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"6402c145-18cc-49a7-9e29-fa9bc47ad3ed","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=e3e08cf9-5f69-4186-9e20-224b161d118e"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/86e43f1f7dee"]}}
{"level":"debug","ts":"2026-07-09T15:36:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"bdd59776-5086-4a8f-82ad-0629e6fa9fab","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/86e43f1f7dee"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=e3e08cf9-5f69-4186-9e20-224b161d118e"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"6402c145-18cc-49a7-9e29-fa9bc47ad3ed","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"1e6fc99fe7cc8411a3c02a2fe5b0ad77d3837b94bc64b178dd8885e76757487a"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.37:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-bf561e.apps.816cbb1a-c3a9-4178-8da2-86e43f1f7dee.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T15:36:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"bdd59776-5086-4a8f-82ad-0629e6fa9fab","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T15:36:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"bdd59776-5086-4a8f-82ad-0629e6fa9fab","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T15:36:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"bdd59776-5086-4a8f-82ad-0629e6fa9fab","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-bf561e/rate-test-model-bf561e\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T15:36:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"bdd59776-5086-4a8f-82ad-0629e6fa9fab","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-09T15:36:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"bdd59776-5086-4a8f-82ad-0629e6fa9fab","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T15:36:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"bdd59776-5086-4a8f-82ad-0629e6fa9fab","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-09T15:36:04Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"bdd59776-5086-4a8f-82ad-0629e6fa9fab","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T15:36:04Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"bdd59776-5086-4a8f-82ad-0629e6fa9fab","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T15:36:04Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"af3189c5-5498-4afa-a0ad-40be95221fcf","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.8:57130","PortSpecifier":{"PortValue":57130}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.65:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"af3189c5-5498-4afa-a0ad-40be95221fcf","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-497419.apps.816cbb1a-c3a9-4178-8da2-86e43f1f7dee.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T15:36:04Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"af3189c5-5498-4afa-a0ad-40be95221fcf","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.8:57130","PortSpecifier":{"PortValue":57130}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.65:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783611364,"nanos":633057258},"http":{"id":"af3189c5-5498-4afa-a0ad-40be95221fcf","method":"POST","headers":{":authority":"e2e-shared-b-497419.apps.816cbb1a-c3a9-4178-8da2-86e43f1f7dee.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T15:36:04Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"af3189c5-5498-4afa-a0ad-40be95221fcf","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-09T15:36:04Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"af3189c5-5498-4afa-a0ad-40be95221fcf","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"6402c145-18cc-49a7-9e29-fa9bc47ad3ed","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=e3e08cf9-5f69-4186-9e20-224b161d118e"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/86e43f1f7dee"]}}
{"level":"debug","ts":"2026-07-09T15:36:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"af3189c5-5498-4afa-a0ad-40be95221fcf","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/86e43f1f7dee"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=e3e08cf9-5f69-4186-9e20-224b161d118e"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"6402c145-18cc-49a7-9e29-fa9bc47ad3ed","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"d5504fe62b8e55ebf23f874bf846c88a4080911486ee2076f2a0ebc2d8e7e6c5"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.65:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-497419.apps.816cbb1a-c3a9-4178-8da2-86e43f1f7dee.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T15:36:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"af3189c5-5498-4afa-a0ad-40be95221fcf","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T15:36:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"af3189c5-5498-4afa-a0ad-40be95221fcf","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T15:36:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"af3189c5-5498-4afa-a0ad-40be95221fcf","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-497419/rate-test-model-497419\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T15:36:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"af3189c5-5498-4afa-a0ad-40be95221fcf","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-09T15:36:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"af3189c5-5498-4afa-a0ad-40be95221fcf","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T15:36:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"af3189c5-5498-4afa-a0ad-40be95221fcf","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-09T15:36:04Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"af3189c5-5498-4afa-a0ad-40be95221fcf","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T15:36:04Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"af3189c5-5498-4afa-a0ad-40be95221fcf","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T15:36:04Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"fdc22035-cf3d-4391-b8c6-7429bad15ac0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.8:39646","PortSpecifier":{"PortValue":39646}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.37:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"fdc22035-cf3d-4391-b8c6-7429bad15ac0","method":"POST","path":"/ai-tenant-e2e-shared-a-bf561e/rate-test-model-bf561e/v1/completions","host":"e2e-shared-a-bf561e.apps.816cbb1a-c3a9-4178-8da2-86e43f1f7dee.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T15:36:04Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"fdc22035-cf3d-4391-b8c6-7429bad15ac0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.8:39646","PortSpecifier":{"PortValue":39646}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.37:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783611364,"nanos":670851563},"http":{"id":"fdc22035-cf3d-4391-b8c6-7429bad15ac0","method":"POST","headers":{":authority":"e2e-shared-a-bf561e.apps.816cbb1a-c3a9-4178-8da2-86e43f1f7dee.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-bf561e/rate-test-model-bf561e/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T15:36:04Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"fdc22035-cf3d-4391-b8c6-7429bad15ac0","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-ZerS17lxATxsq2xL_fmJKiEi321SeC8U6R6m0O4dPh2yH0zYnI6uj7vnTagU"}
{"level":"debug","ts":"2026-07-09T15:36:04Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"fdc22035-cf3d-4391-b8c6-7429bad15ac0","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-bf561e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-ZerS17lxATxsq2xL_fmJKiEi321SeC8U6R6m0O4dPh2yH0zYnI6uj7vnTagU\"}"}
{"level":"debug","ts":"2026-07-09T15:36:04Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"fdc22035-cf3d-4391-b8c6-7429bad15ac0","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-bf561e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"e7c72d29-849c-4810-b762-4d55ddec744f","keyName":"e2e-rate-a-784500","subscription":"e2e-rate-iso-a-784500","tenant":"e2e-shared-a-bf561e","userId":"e7c72d29-849c-4810-b762-4d55ddec744f","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T15:36:04Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"fdc22035-cf3d-4391-b8c6-7429bad15ac0","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-bf561e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-bf561e/rate-test-model-bf561e\",\"requestedSubscription\":\"e2e-rate-iso-a-784500\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-09T15:36:04Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"fdc22035-cf3d-4391-b8c6-7429bad15ac0","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-bf561e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-bf561e","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-784500","namespace":"ai-tenant-e2e-shared-a-bf561e","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-09T15:36:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"fdc22035-cf3d-4391-b8c6-7429bad15ac0","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T15:36:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fdc22035-cf3d-4391-b8c6-7429bad15ac0","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T15:36:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fdc22035-cf3d-4391-b8c6-7429bad15ac0","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T15:36:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fdc22035-cf3d-4391-b8c6-7429bad15ac0","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T15:36:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fdc22035-cf3d-4391-b8c6-7429bad15ac0","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-bf561e/rate-test-model-bf561e\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T15:36:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"fdc22035-cf3d-4391-b8c6-7429bad15ac0","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T15:36:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"fdc22035-cf3d-4391-b8c6-7429bad15ac0","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T15:36:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"fdc22035-cf3d-4391-b8c6-7429bad15ac0","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-784500"}
{"level":"debug","ts":"2026-07-09T15:36:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"fdc22035-cf3d-4391-b8c6-7429bad15ac0","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"e7c72d29-849c-4810-b762-4d55ddec744f","keyName":"e2e-rate-a-784500","selected_subscription":"e2e-rate-iso-a-784500","selected_subscription_key":"ai-tenant-e2e-shared-a-bf561e/e2e-rate-iso-a-784500@ai-tenant-e2e-shared-a-bf561e/rate-test-model-bf561e","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-bf561e","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-784500","namespace":"ai-tenant-e2e-shared-a-bf561e","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-09T15:36:04Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"fdc22035-cf3d-4391-b8c6-7429bad15ac0","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T15:36:04Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"fdc22035-cf3d-4391-b8c6-7429bad15ac0","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T15:36:05Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"70ff21eb-2a39-440b-a39a-991d6d831406","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.8:39660","PortSpecifier":{"PortValue":39660}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.37:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"70ff21eb-2a39-440b-a39a-991d6d831406","method":"POST","path":"/ai-tenant-e2e-shared-a-bf561e/rate-test-model-bf561e/v1/completions","host":"e2e-shared-a-bf561e.apps.816cbb1a-c3a9-4178-8da2-86e43f1f7dee.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T15:36:05Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"70ff21eb-2a39-440b-a39a-991d6d831406","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.8:39660","PortSpecifier":{"PortValue":39660}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.37:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783611365,"nanos":728968306},"http":{"id":"70ff21eb-2a39-440b-a39a-991d6d831406","method":"POST","headers":{":authority":"e2e-shared-a-bf561e.apps.816cbb1a-c3a9-4178-8da2-86e43f1f7dee.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-bf561e/rate-test-model-bf561e/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T15:36:05Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"70ff21eb-2a39-440b-a39a-991d6d831406","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-ZerS17lxATxsq2xL_fmJKiEi321SeC8U6R6m0O4dPh2yH0zYnI6uj7vnTagU"}
{"level":"debug","ts":"2026-07-09T15:36:05Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"70ff21eb-2a39-440b-a39a-991d6d831406","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-bf561e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-ZerS17lxATxsq2xL_fmJKiEi321SeC8U6R6m0O4dPh2yH0zYnI6uj7vnTagU\"}"}
{"level":"debug","ts":"2026-07-09T15:36:05Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"70ff21eb-2a39-440b-a39a-991d6d831406","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-bf561e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"e7c72d29-849c-4810-b762-4d55ddec744f","keyName":"e2e-rate-a-784500","subscription":"e2e-rate-iso-a-784500","tenant":"e2e-shared-a-bf561e","userId":"e7c72d29-849c-4810-b762-4d55ddec744f","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T15:36:05Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"70ff21eb-2a39-440b-a39a-991d6d831406","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-bf561e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-bf561e/rate-test-model-bf561e\",\"requestedSubscription\":\"e2e-rate-iso-a-784500\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-09T15:36:05Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"70ff21eb-2a39-440b-a39a-991d6d831406","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-bf561e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-bf561e","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-784500","namespace":"ai-tenant-e2e-shared-a-bf561e","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-09T15:36:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"70ff21eb-2a39-440b-a39a-991d6d831406","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T15:36:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"70ff21eb-2a39-440b-a39a-991d6d831406","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T15:36:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"70ff21eb-2a39-440b-a39a-991d6d831406","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T15:36:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"70ff21eb-2a39-440b-a39a-991d6d831406","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T15:36:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"70ff21eb-2a39-440b-a39a-991d6d831406","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-bf561e/rate-test-model-bf561e\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T15:36:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"70ff21eb-2a39-440b-a39a-991d6d831406","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T15:36:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"70ff21eb-2a39-440b-a39a-991d6d831406","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T15:36:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"70ff21eb-2a39-440b-a39a-991d6d831406","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-784500"}
{"level":"debug","ts":"2026-07-09T15:36:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"70ff21eb-2a39-440b-a39a-991d6d831406","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"e7c72d29-849c-4810-b762-4d55ddec744f","keyName":"e2e-rate-a-784500","selected_subscription":"e2e-rate-iso-a-784500","selected_subscription_key":"ai-tenant-e2e-shared-a-bf561e/e2e-rate-iso-a-784500@ai-tenant-e2e-shared-a-bf561e/rate-test-model-bf561e","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-bf561e","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-784500","namespace":"ai-tenant-e2e-shared-a-bf561e","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-09T15:36:05Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"70ff21eb-2a39-440b-a39a-991d6d831406","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T15:36:05Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"70ff21eb-2a39-440b-a39a-991d6d831406","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T15:36:06Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"851862f3-f54c-480e-ad95-8f6e4c975af2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.8:39670","PortSpecifier":{"PortValue":39670}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.37:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"851862f3-f54c-480e-ad95-8f6e4c975af2","method":"POST","path":"/ai-tenant-e2e-shared-a-bf561e/rate-test-model-bf561e/v1/completions","host":"e2e-shared-a-bf561e.apps.816cbb1a-c3a9-4178-8da2-86e43f1f7dee.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T15:36:06Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"851862f3-f54c-480e-ad95-8f6e4c975af2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.8:39670","PortSpecifier":{"PortValue":39670}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.37:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783611366,"nanos":762606256},"http":{"id":"851862f3-f54c-480e-ad95-8f6e4c975af2","method":"POST","headers":{":authority":"e2e-shared-a-bf561e.apps.816cbb1a-c3a9-4178-8da2-86e43f1f7dee.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-bf561e/rate-test-model-bf561e/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T15:36:06Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"851862f3-f54c-480e-ad95-8f6e4c975af2","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-ZerS17lxATxsq2xL_fmJKiEi321SeC8U6R6m0O4dPh2yH0zYnI6uj7vnTagU"}
{"level":"debug","ts":"2026-07-09T15:36:06Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"851862f3-f54c-480e-ad95-8f6e4c975af2","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-bf561e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-ZerS17lxATxsq2xL_fmJKiEi321SeC8U6R6m0O4dPh2yH0zYnI6uj7vnTagU\"}"}
{"level":"debug","ts":"2026-07-09T15:36:06Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"851862f3-f54c-480e-ad95-8f6e4c975af2","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-bf561e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"e7c72d29-849c-4810-b762-4d55ddec744f","keyName":"e2e-rate-a-784500","subscription":"e2e-rate-iso-a-784500","tenant":"e2e-shared-a-bf561e","userId":"e7c72d29-849c-4810-b762-4d55ddec744f","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T15:36:06Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"851862f3-f54c-480e-ad95-8f6e4c975af2","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-bf561e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-bf561e/rate-test-model-bf561e\",\"requestedSubscription\":\"e2e-rate-iso-a-784500\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-09T15:36:06Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"851862f3-f54c-480e-ad95-8f6e4c975af2","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-bf561e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-bf561e","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-784500","namespace":"ai-tenant-e2e-shared-a-bf561e","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-09T15:36:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"851862f3-f54c-480e-ad95-8f6e4c975af2","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T15:36:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"851862f3-f54c-480e-ad95-8f6e4c975af2","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T15:36:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"851862f3-f54c-480e-ad95-8f6e4c975af2","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T15:36:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"851862f3-f54c-480e-ad95-8f6e4c975af2","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T15:36:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"851862f3-f54c-480e-ad95-8f6e4c975af2","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-bf561e/rate-test-model-bf561e\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T15:36:06Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"851862f3-f54c-480e-ad95-8f6e4c975af2","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-784500"}
{"level":"debug","ts":"2026-07-09T15:36:06Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"851862f3-f54c-480e-ad95-8f6e4c975af2","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T15:36:06Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"851862f3-f54c-480e-ad95-8f6e4c975af2","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T15:36:06Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"851862f3-f54c-480e-ad95-8f6e4c975af2","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"e7c72d29-849c-4810-b762-4d55ddec744f","keyName":"e2e-rate-a-784500","selected_subscription":"e2e-rate-iso-a-784500","selected_subscription_key":"ai-tenant-e2e-shared-a-bf561e/e2e-rate-iso-a-784500@ai-tenant-e2e-shared-a-bf561e/rate-test-model-bf561e","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-bf561e","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-784500","namespace":"ai-tenant-e2e-shared-a-bf561e","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-09T15:36:06Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"851862f3-f54c-480e-ad95-8f6e4c975af2","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T15:36:06Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"851862f3-f54c-480e-ad95-8f6e4c975af2","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T15:36:15Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"df9ccbd1-9069-48f5-bee2-81965383fdb1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.8:53682","PortSpecifier":{"PortValue":53682}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.37:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"df9ccbd1-9069-48f5-bee2-81965383fdb1","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-bf561e.apps.816cbb1a-c3a9-4178-8da2-86e43f1f7dee.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T15:36:15Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"df9ccbd1-9069-48f5-bee2-81965383fdb1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.8:53682","PortSpecifier":{"PortValue":53682}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.37:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783611375,"nanos":489658519},"http":{"id":"df9ccbd1-9069-48f5-bee2-81965383fdb1","method":"POST","headers":{":authority":"e2e-shared-a-bf561e.apps.816cbb1a-c3a9-4178-8da2-86e43f1f7dee.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T15:36:15Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"df9ccbd1-9069-48f5-bee2-81965383fdb1","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-09T15:36:15Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"df9ccbd1-9069-48f5-bee2-81965383fdb1","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"6402c145-18cc-49a7-9e29-fa9bc47ad3ed","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=e3e08cf9-5f69-4186-9e20-224b161d118e"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/86e43f1f7dee"]}}
{"level":"debug","ts":"2026-07-09T15:36:15Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"df9ccbd1-9069-48f5-bee2-81965383fdb1","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/86e43f1f7dee"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=e3e08cf9-5f69-4186-9e20-224b161d118e"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"6402c145-18cc-49a7-9e29-fa9bc47ad3ed","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"1e6fc99fe7cc8411a3c02a2fe5b0ad77d3837b94bc64b178dd8885e76757487a"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.37:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-bf561e.apps.816cbb1a-c3a9-4178-8da2-86e43f1f7dee.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T15:36:15Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"df9ccbd1-9069-48f5-bee2-81965383fdb1","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T15:36:15Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"df9ccbd1-9069-48f5-bee2-81965383fdb1","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T15:36:15Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"df9ccbd1-9069-48f5-bee2-81965383fdb1","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-bf561e/rate-test-model-bf561e\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T15:36:15Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"df9ccbd1-9069-48f5-bee2-81965383fdb1","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-09T15:36:15Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"df9ccbd1-9069-48f5-bee2-81965383fdb1","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T15:36:15Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"df9ccbd1-9069-48f5-bee2-81965383fdb1","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-09T15:36:15Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"df9ccbd1-9069-48f5-bee2-81965383fdb1","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T15:36:15Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"df9ccbd1-9069-48f5-bee2-81965383fdb1","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T15:36:15Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ddddc228-9f9c-4530-8c45-8b287a067b24","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.8:37160","PortSpecifier":{"PortValue":37160}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.65:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"ddddc228-9f9c-4530-8c45-8b287a067b24","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-497419.apps.816cbb1a-c3a9-4178-8da2-86e43f1f7dee.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T15:36:15Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ddddc228-9f9c-4530-8c45-8b287a067b24","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.8:37160","PortSpecifier":{"PortValue":37160}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.65:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783611375,"nanos":527024740},"http":{"id":"ddddc228-9f9c-4530-8c45-8b287a067b24","method":"POST","headers":{":authority":"e2e-shared-b-497419.apps.816cbb1a-c3a9-4178-8da2-86e43f1f7dee.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T15:36:15Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"ddddc228-9f9c-4530-8c45-8b287a067b24","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-09T15:36:15Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"ddddc228-9f9c-4530-8c45-8b287a067b24","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"6402c145-18cc-49a7-9e29-fa9bc47ad3ed","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=e3e08cf9-5f69-4186-9e20-224b161d118e"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/86e43f1f7dee"]}}
{"level":"debug","ts":"2026-07-09T15:36:15Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"ddddc228-9f9c-4530-8c45-8b287a067b24","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/86e43f1f7dee"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=e3e08cf9-5f69-4186-9e20-224b161d118e"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"6402c145-18cc-49a7-9e29-fa9bc47ad3ed","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"d5504fe62b8e55ebf23f874bf846c88a4080911486ee2076f2a0ebc2d8e7e6c5"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.65:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-497419.apps.816cbb1a-c3a9-4178-8da2-86e43f1f7dee.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T15:36:15Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ddddc228-9f9c-4530-8c45-8b287a067b24","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T15:36:15Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ddddc228-9f9c-4530-8c45-8b287a067b24","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T15:36:15Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ddddc228-9f9c-4530-8c45-8b287a067b24","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-497419/rate-test-model-497419\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T15:36:15Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"ddddc228-9f9c-4530-8c45-8b287a067b24","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-09T15:36:15Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ddddc228-9f9c-4530-8c45-8b287a067b24","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T15:36:15Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ddddc228-9f9c-4530-8c45-8b287a067b24","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-09T15:36:15Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ddddc228-9f9c-4530-8c45-8b287a067b24","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T15:36:15Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ddddc228-9f9c-4530-8c45-8b287a067b24","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T15:36:15Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"17efbe74-f9b7-4d6e-b807-dd99c5e8ec24","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.8:53696","PortSpecifier":{"PortValue":53696}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.37:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"17efbe74-f9b7-4d6e-b807-dd99c5e8ec24","method":"POST","path":"/ai-tenant-e2e-shared-a-bf561e/rate-test-model-bf561e/v1/completions","host":"e2e-shared-a-bf561e.apps.816cbb1a-c3a9-4178-8da2-86e43f1f7dee.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T15:36:15Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"17efbe74-f9b7-4d6e-b807-dd99c5e8ec24","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.8:53696","PortSpecifier":{"PortValue":53696}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.37:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783611375,"nanos":562267453},"http":{"id":"17efbe74-f9b7-4d6e-b807-dd99c5e8ec24","method":"POST","headers":{":authority":"e2e-shared-a-bf561e.apps.816cbb1a-c3a9-4178-8da2-86e43f1f7dee.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-bf561e/rate-test-model-bf561e/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T15:36:15Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"17efbe74-f9b7-4d6e-b807-dd99c5e8ec24","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1XlPl7UqZUvfoQwvx_hgeifOqBV9dwBIIv4B945hJxhACwo6ngjjnL7b5GqDL"}
{"level":"debug","ts":"2026-07-09T15:36:15Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"17efbe74-f9b7-4d6e-b807-dd99c5e8ec24","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-bf561e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1XlPl7UqZUvfoQwvx_hgeifOqBV9dwBIIv4B945hJxhACwo6ngjjnL7b5GqDL\"}"}
{"level":"debug","ts":"2026-07-09T15:36:15Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"17efbe74-f9b7-4d6e-b807-dd99c5e8ec24","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-bf561e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"1462175f-75e5-4f57-9cc8-8286ce94a240","keyName":"e2e-rate-a-a8872e","subscription":"e2e-rate-iso-a-a8872e","tenant":"e2e-shared-a-bf561e","userId":"1462175f-75e5-4f57-9cc8-8286ce94a240","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T15:36:15Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"17efbe74-f9b7-4d6e-b807-dd99c5e8ec24","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-bf561e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-bf561e/rate-test-model-bf561e\",\"requestedSubscription\":\"e2e-rate-iso-a-a8872e\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-09T15:36:15Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"17efbe74-f9b7-4d6e-b807-dd99c5e8ec24","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-bf561e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-bf561e","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-a8872e","namespace":"ai-tenant-e2e-shared-a-bf561e","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-09T15:36:15Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"17efbe74-f9b7-4d6e-b807-dd99c5e8ec24","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T15:36:15Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"17efbe74-f9b7-4d6e-b807-dd99c5e8ec24","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T15:36:15Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"17efbe74-f9b7-4d6e-b807-dd99c5e8ec24","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T15:36:15Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"17efbe74-f9b7-4d6e-b807-dd99c5e8ec24","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-bf561e/rate-test-model-bf561e\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T15:36:15Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"17efbe74-f9b7-4d6e-b807-dd99c5e8ec24","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T15:36:15Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"17efbe74-f9b7-4d6e-b807-dd99c5e8ec24","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T15:36:15Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"17efbe74-f9b7-4d6e-b807-dd99c5e8ec24","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-a8872e"}
{"level":"debug","ts":"2026-07-09T15:36:15Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"17efbe74-f9b7-4d6e-b807-dd99c5e8ec24","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T15:36:15Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"17efbe74-f9b7-4d6e-b807-dd99c5e8ec24","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"1462175f-75e5-4f57-9cc8-8286ce94a240","keyName":"e2e-rate-a-a8872e","selected_subscription":"e2e-rate-iso-a-a8872e","selected_subscription_key":"ai-tenant-e2e-shared-a-bf561e/e2e-rate-iso-a-a8872e@ai-tenant-e2e-shared-a-bf561e/rate-test-model-bf561e","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-bf561e","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-a8872e","namespace":"ai-tenant-e2e-shared-a-bf561e","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-09T15:36:15Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"17efbe74-f9b7-4d6e-b807-dd99c5e8ec24","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T15:36:15Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"17efbe74-f9b7-4d6e-b807-dd99c5e8ec24","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T15:36:16Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9777e62f-e928-4fae-b321-6d003187a279","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.8:53698","PortSpecifier":{"PortValue":53698}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.37:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"9777e62f-e928-4fae-b321-6d003187a279","method":"POST","path":"/ai-tenant-e2e-shared-a-bf561e/rate-test-model-bf561e/v1/completions","host":"e2e-shared-a-bf561e.apps.816cbb1a-c3a9-4178-8da2-86e43f1f7dee.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T15:36:16Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9777e62f-e928-4fae-b321-6d003187a279","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.8:53698","PortSpecifier":{"PortValue":53698}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.37:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783611376,"nanos":594882522},"http":{"id":"9777e62f-e928-4fae-b321-6d003187a279","method":"POST","headers":{":authority":"e2e-shared-a-bf561e.apps.816cbb1a-c3a9-4178-8da2-86e43f1f7dee.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-bf561e/rate-test-model-bf561e/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T15:36:16Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"9777e62f-e928-4fae-b321-6d003187a279","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1XlPl7UqZUvfoQwvx_hgeifOqBV9dwBIIv4B945hJxhACwo6ngjjnL7b5GqDL"}
{"level":"debug","ts":"2026-07-09T15:36:16Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"9777e62f-e928-4fae-b321-6d003187a279","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-bf561e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1XlPl7UqZUvfoQwvx_hgeifOqBV9dwBIIv4B945hJxhACwo6ngjjnL7b5GqDL\"}"}
{"level":"debug","ts":"2026-07-09T15:36:16Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"9777e62f-e928-4fae-b321-6d003187a279","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-bf561e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"1462175f-75e5-4f57-9cc8-8286ce94a240","keyName":"e2e-rate-a-a8872e","subscription":"e2e-rate-iso-a-a8872e","tenant":"e2e-shared-a-bf561e","userId":"1462175f-75e5-4f57-9cc8-8286ce94a240","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T15:36:16Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"9777e62f-e928-4fae-b321-6d003187a279","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-bf561e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-bf561e/rate-test-model-bf561e\",\"requestedSubscription\":\"e2e-rate-iso-a-a8872e\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-09T15:36:16Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"9777e62f-e928-4fae-b321-6d003187a279","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-bf561e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-bf561e","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-a8872e","namespace":"ai-tenant-e2e-shared-a-bf561e","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-09T15:36:16Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"9777e62f-e928-4fae-b321-6d003187a279","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T15:36:16Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9777e62f-e928-4fae-b321-6d003187a279","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T15:36:16Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9777e62f-e928-4fae-b321-6d003187a279","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T15:36:16Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9777e62f-e928-4fae-b321-6d003187a279","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T15:36:16Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9777e62f-e928-4fae-b321-6d003187a279","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-bf561e/rate-test-model-bf561e\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T15:36:16Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9777e62f-e928-4fae-b321-6d003187a279","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-a8872e"}
{"level":"debug","ts":"2026-07-09T15:36:16Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9777e62f-e928-4fae-b321-6d003187a279","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T15:36:16Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9777e62f-e928-4fae-b321-6d003187a279","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T15:36:16Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9777e62f-e928-4fae-b321-6d003187a279","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"1462175f-75e5-4f57-9cc8-8286ce94a240","keyName":"e2e-rate-a-a8872e","selected_subscription":"e2e-rate-iso-a-a8872e","selected_subscription_key":"ai-tenant-e2e-shared-a-bf561e/e2e-rate-iso-a-a8872e@ai-tenant-e2e-shared-a-bf561e/rate-test-model-bf561e","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-bf561e","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-a8872e","namespace":"ai-tenant-e2e-shared-a-bf561e","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-09T15:36:16Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9777e62f-e928-4fae-b321-6d003187a279","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T15:36:16Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9777e62f-e928-4fae-b321-6d003187a279","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T15:36:17Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5cd5fb1a-ff7c-42c1-9219-71d967141aa2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.8:53712","PortSpecifier":{"PortValue":53712}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.37:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"5cd5fb1a-ff7c-42c1-9219-71d967141aa2","method":"POST","path":"/ai-tenant-e2e-shared-a-bf561e/rate-test-model-bf561e/v1/completions","host":"e2e-shared-a-bf561e.apps.816cbb1a-c3a9-4178-8da2-86e43f1f7dee.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T15:36:17Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5cd5fb1a-ff7c-42c1-9219-71d967141aa2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.8:53712","PortSpecifier":{"PortValue":53712}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.37:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783611377,"nanos":631644725},"http":{"id":"5cd5fb1a-ff7c-42c1-9219-71d967141aa2","method":"POST","headers":{":authority":"e2e-shared-a-bf561e.apps.816cbb1a-c3a9-4178-8da2-86e43f1f7dee.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-bf561e/rate-test-model-bf561e/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T15:36:17Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"5cd5fb1a-ff7c-42c1-9219-71d967141aa2","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1XlPl7UqZUvfoQwvx_hgeifOqBV9dwBIIv4B945hJxhACwo6ngjjnL7b5GqDL"}
{"level":"debug","ts":"2026-07-09T15:36:17Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"5cd5fb1a-ff7c-42c1-9219-71d967141aa2","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-bf561e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1XlPl7UqZUvfoQwvx_hgeifOqBV9dwBIIv4B945hJxhACwo6ngjjnL7b5GqDL\"}"}
{"level":"debug","ts":"2026-07-09T15:36:17Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"5cd5fb1a-ff7c-42c1-9219-71d967141aa2","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-bf561e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"1462175f-75e5-4f57-9cc8-8286ce94a240","keyName":"e2e-rate-a-a8872e","subscription":"e2e-rate-iso-a-a8872e","tenant":"e2e-shared-a-bf561e","userId":"1462175f-75e5-4f57-9cc8-8286ce94a240","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T15:36:17Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"5cd5fb1a-ff7c-42c1-9219-71d967141aa2","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-bf561e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-bf561e/rate-test-model-bf561e\",\"requestedSubscription\":\"e2e-rate-iso-a-a8872e\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-09T15:36:17Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"5cd5fb1a-ff7c-42c1-9219-71d967141aa2","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-bf561e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-bf561e","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-a8872e","namespace":"ai-tenant-e2e-shared-a-bf561e","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-09T15:36:17Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"5cd5fb1a-ff7c-42c1-9219-71d967141aa2","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T15:36:17Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5cd5fb1a-ff7c-42c1-9219-71d967141aa2","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T15:36:17Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5cd5fb1a-ff7c-42c1-9219-71d967141aa2","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T15:36:17Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5cd5fb1a-ff7c-42c1-9219-71d967141aa2","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-bf561e/rate-test-model-bf561e\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T15:36:17Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5cd5fb1a-ff7c-42c1-9219-71d967141aa2","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T15:36:17Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5cd5fb1a-ff7c-42c1-9219-71d967141aa2","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T15:36:17Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5cd5fb1a-ff7c-42c1-9219-71d967141aa2","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T15:36:17Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5cd5fb1a-ff7c-42c1-9219-71d967141aa2","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-a8872e"}
{"level":"debug","ts":"2026-07-09T15:36:17Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5cd5fb1a-ff7c-42c1-9219-71d967141aa2","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"1462175f-75e5-4f57-9cc8-8286ce94a240","keyName":"e2e-rate-a-a8872e","selected_subscription":"e2e-rate-iso-a-a8872e","selected_subscription_key":"ai-tenant-e2e-shared-a-bf561e/e2e-rate-iso-a-a8872e@ai-tenant-e2e-shared-a-bf561e/rate-test-model-bf561e","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-bf561e","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-a8872e","namespace":"ai-tenant-e2e-shared-a-bf561e","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-09T15:36:17Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5cd5fb1a-ff7c-42c1-9219-71d967141aa2","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T15:36:17Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5cd5fb1a-ff7c-42c1-9219-71d967141aa2","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T15:36:18Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"62797765-bef9-4158-a418-f18e7a567874","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.8:53726","PortSpecifier":{"PortValue":53726}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.37:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"62797765-bef9-4158-a418-f18e7a567874","method":"POST","path":"/ai-tenant-e2e-shared-a-bf561e/rate-test-model-bf561e/v1/completions","host":"e2e-shared-a-bf561e.apps.816cbb1a-c3a9-4178-8da2-86e43f1f7dee.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T15:36:18Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"62797765-bef9-4158-a418-f18e7a567874","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.8:53726","PortSpecifier":{"PortValue":53726}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.37:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783611378,"nanos":666958916},"http":{"id":"62797765-bef9-4158-a418-f18e7a567874","method":"POST","headers":{":authority":"e2e-shared-a-bf561e.apps.816cbb1a-c3a9-4178-8da2-86e43f1f7dee.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-bf561e/rate-test-model-bf561e/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T15:36:18Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"62797765-bef9-4158-a418-f18e7a567874","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1XlPl7UqZUvfoQwvx_hgeifOqBV9dwBIIv4B945hJxhACwo6ngjjnL7b5GqDL"}
{"level":"debug","ts":"2026-07-09T15:36:18Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"62797765-bef9-4158-a418-f18e7a567874","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-bf561e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1XlPl7UqZUvfoQwvx_hgeifOqBV9dwBIIv4B945hJxhACwo6ngjjnL7b5GqDL\"}"}
{"level":"debug","ts":"2026-07-09T15:36:18Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"62797765-bef9-4158-a418-f18e7a567874","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-bf561e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"1462175f-75e5-4f57-9cc8-8286ce94a240","keyName":"e2e-rate-a-a8872e","subscription":"e2e-rate-iso-a-a8872e","tenant":"e2e-shared-a-bf561e","userId":"1462175f-75e5-4f57-9cc8-8286ce94a240","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T15:36:18Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"62797765-bef9-4158-a418-f18e7a567874","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-bf561e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-bf561e/rate-test-model-bf561e\",\"requestedSubscription\":\"e2e-rate-iso-a-a8872e\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-09T15:36:18Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"62797765-bef9-4158-a418-f18e7a567874","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-bf561e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-bf561e","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-a8872e","namespace":"ai-tenant-e2e-shared-a-bf561e","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-09T15:36:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"62797765-bef9-4158-a418-f18e7a567874","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T15:36:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"62797765-bef9-4158-a418-f18e7a567874","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T15:36:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"62797765-bef9-4158-a418-f18e7a567874","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T15:36:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"62797765-bef9-4158-a418-f18e7a567874","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-bf561e/rate-test-model-bf561e\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T15:36:18Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"62797765-bef9-4158-a418-f18e7a567874","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T15:36:18Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"62797765-bef9-4158-a418-f18e7a567874","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T15:36:18Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"62797765-bef9-4158-a418-f18e7a567874","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-a8872e"}
{"level":"debug","ts":"2026-07-09T15:36:18Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"62797765-bef9-4158-a418-f18e7a567874","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T15:36:18Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"62797765-bef9-4158-a418-f18e7a567874","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"1462175f-75e5-4f57-9cc8-8286ce94a240","keyName":"e2e-rate-a-a8872e","selected_subscription":"e2e-rate-iso-a-a8872e","selected_subscription_key":"ai-tenant-e2e-shared-a-bf561e/e2e-rate-iso-a-a8872e@ai-tenant-e2e-shared-a-bf561e/rate-test-model-bf561e","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-bf561e","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-a8872e","namespace":"ai-tenant-e2e-shared-a-bf561e","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-09T15:36:18Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"62797765-bef9-4158-a418-f18e7a567874","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T15:36:18Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"62797765-bef9-4158-a418-f18e7a567874","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T15:36:19Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"bbca39ed-88da-4107-bd04-de028fb41900","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.8:53738","PortSpecifier":{"PortValue":53738}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.37:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"bbca39ed-88da-4107-bd04-de028fb41900","method":"POST","path":"/ai-tenant-e2e-shared-a-bf561e/rate-test-model-bf561e/v1/completions","host":"e2e-shared-a-bf561e.apps.816cbb1a-c3a9-4178-8da2-86e43f1f7dee.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T15:36:19Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"bbca39ed-88da-4107-bd04-de028fb41900","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.8:53738","PortSpecifier":{"PortValue":53738}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.37:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783611379,"nanos":710915348},"http":{"id":"bbca39ed-88da-4107-bd04-de028fb41900","method":"POST","headers":{":authority":"e2e-shared-a-bf561e.apps.816cbb1a-c3a9-4178-8da2-86e43f1f7dee.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-bf561e/rate-test-model-bf561e/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T15:36:19Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"bbca39ed-88da-4107-bd04-de028fb41900","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1XlPl7UqZUvfoQwvx_hgeifOqBV9dwBIIv4B945hJxhACwo6ngjjnL7b5GqDL"}
{"level":"debug","ts":"2026-07-09T15:36:19Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"bbca39ed-88da-4107-bd04-de028fb41900","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-bf561e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1XlPl7UqZUvfoQwvx_hgeifOqBV9dwBIIv4B945hJxhACwo6ngjjnL7b5GqDL\"}"}
{"level":"debug","ts":"2026-07-09T15:36:19Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"bbca39ed-88da-4107-bd04-de028fb41900","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-bf561e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"1462175f-75e5-4f57-9cc8-8286ce94a240","keyName":"e2e-rate-a-a8872e","subscription":"e2e-rate-iso-a-a8872e","tenant":"e2e-shared-a-bf561e","userId":"1462175f-75e5-4f57-9cc8-8286ce94a240","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T15:36:19Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"bbca39ed-88da-4107-bd04-de028fb41900","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-bf561e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-bf561e/rate-test-model-bf561e\",\"requestedSubscription\":\"e2e-rate-iso-a-a8872e\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-09T15:36:19Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"bbca39ed-88da-4107-bd04-de028fb41900","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-bf561e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-bf561e","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-a8872e","namespace":"ai-tenant-e2e-shared-a-bf561e","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-09T15:36:19Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"bbca39ed-88da-4107-bd04-de028fb41900","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T15:36:19Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"bbca39ed-88da-4107-bd04-de028fb41900","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T15:36:19Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"bbca39ed-88da-4107-bd04-de028fb41900","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T15:36:19Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"bbca39ed-88da-4107-bd04-de028fb41900","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T15:36:19Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"bbca39ed-88da-4107-bd04-de028fb41900","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-bf561e/rate-test-model-bf561e\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T15:36:19Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"bbca39ed-88da-4107-bd04-de028fb41900","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T15:36:19Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"bbca39ed-88da-4107-bd04-de028fb41900","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-a8872e"}
{"level":"debug","ts":"2026-07-09T15:36:19Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"bbca39ed-88da-4107-bd04-de028fb41900","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T15:36:19Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"bbca39ed-88da-4107-bd04-de028fb41900","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"1462175f-75e5-4f57-9cc8-8286ce94a240","keyName":"e2e-rate-a-a8872e","selected_subscription":"e2e-rate-iso-a-a8872e","selected_subscription_key":"ai-tenant-e2e-shared-a-bf561e/e2e-rate-iso-a-a8872e@ai-tenant-e2e-shared-a-bf561e/rate-test-model-bf561e","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-bf561e","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-a8872e","namespace":"ai-tenant-e2e-shared-a-bf561e","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-09T15:36:19Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"bbca39ed-88da-4107-bd04-de028fb41900","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T15:36:19Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"bbca39ed-88da-4107-bd04-de028fb41900","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T15:36:20Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"53d2a762-9ab0-4e22-a382-826b49012c18","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.8:57162","PortSpecifier":{"PortValue":57162}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.37:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"53d2a762-9ab0-4e22-a382-826b49012c18","method":"POST","path":"/ai-tenant-e2e-shared-a-bf561e/rate-test-model-bf561e/v1/completions","host":"e2e-shared-a-bf561e.apps.816cbb1a-c3a9-4178-8da2-86e43f1f7dee.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T15:36:20Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"53d2a762-9ab0-4e22-a382-826b49012c18","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.8:57162","PortSpecifier":{"PortValue":57162}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.37:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783611380,"nanos":752420776},"http":{"id":"53d2a762-9ab0-4e22-a382-826b49012c18","method":"POST","headers":{":authority":"e2e-shared-a-bf561e.apps.816cbb1a-c3a9-4178-8da2-86e43f1f7dee.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-bf561e/rate-test-model-bf561e/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T15:36:20Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"53d2a762-9ab0-4e22-a382-826b49012c18","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1XlPl7UqZUvfoQwvx_hgeifOqBV9dwBIIv4B945hJxhACwo6ngjjnL7b5GqDL"}
{"level":"debug","ts":"2026-07-09T15:36:20Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"53d2a762-9ab0-4e22-a382-826b49012c18","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-bf561e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1XlPl7UqZUvfoQwvx_hgeifOqBV9dwBIIv4B945hJxhACwo6ngjjnL7b5GqDL\"}"}
{"level":"debug","ts":"2026-07-09T15:36:20Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"53d2a762-9ab0-4e22-a382-826b49012c18","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-bf561e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"1462175f-75e5-4f57-9cc8-8286ce94a240","keyName":"e2e-rate-a-a8872e","subscription":"e2e-rate-iso-a-a8872e","tenant":"e2e-shared-a-bf561e","userId":"1462175f-75e5-4f57-9cc8-8286ce94a240","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T15:36:20Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"53d2a762-9ab0-4e22-a382-826b49012c18","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-bf561e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-bf561e/rate-test-model-bf561e\",\"requestedSubscription\":\"e2e-rate-iso-a-a8872e\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-09T15:36:20Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"53d2a762-9ab0-4e22-a382-826b49012c18","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-bf561e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-bf561e","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-a8872e","namespace":"ai-tenant-e2e-shared-a-bf561e","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-09T15:36:20Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"53d2a762-9ab0-4e22-a382-826b49012c18","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T15:36:20Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"53d2a762-9ab0-4e22-a382-826b49012c18","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T15:36:20Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"53d2a762-9ab0-4e22-a382-826b49012c18","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T15:36:20Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"53d2a762-9ab0-4e22-a382-826b49012c18","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T15:36:20Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"53d2a762-9ab0-4e22-a382-826b49012c18","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-bf561e/rate-test-model-bf561e\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T15:36:20Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"53d2a762-9ab0-4e22-a382-826b49012c18","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-a8872e"}
{"level":"debug","ts":"2026-07-09T15:36:20Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"53d2a762-9ab0-4e22-a382-826b49012c18","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T15:36:20Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"53d2a762-9ab0-4e22-a382-826b49012c18","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T15:36:20Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"53d2a762-9ab0-4e22-a382-826b49012c18","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"1462175f-75e5-4f57-9cc8-8286ce94a240","keyName":"e2e-rate-a-a8872e","selected_subscription":"e2e-rate-iso-a-a8872e","selected_subscription_key":"ai-tenant-e2e-shared-a-bf561e/e2e-rate-iso-a-a8872e@ai-tenant-e2e-shared-a-bf561e/rate-test-model-bf561e","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-bf561e","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-a8872e","namespace":"ai-tenant-e2e-shared-a-bf561e","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-09T15:36:20Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"53d2a762-9ab0-4e22-a382-826b49012c18","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T15:36:20Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"53d2a762-9ab0-4e22-a382-826b49012c18","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T15:36:21Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1f7ed21a-afcf-4dca-a274-c5db7328454c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.8:57166","PortSpecifier":{"PortValue":57166}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.37:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"1f7ed21a-afcf-4dca-a274-c5db7328454c","method":"POST","path":"/ai-tenant-e2e-shared-a-bf561e/rate-test-model-bf561e/v1/completions","host":"e2e-shared-a-bf561e.apps.816cbb1a-c3a9-4178-8da2-86e43f1f7dee.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T15:36:21Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1f7ed21a-afcf-4dca-a274-c5db7328454c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.8:57166","PortSpecifier":{"PortValue":57166}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.37:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783611381,"nanos":789109009},"http":{"id":"1f7ed21a-afcf-4dca-a274-c5db7328454c","method":"POST","headers":{":authority":"e2e-shared-a-bf561e.apps.816cbb1a-c3a9-4178-8da2-86e43f1f7dee.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-bf561e/rate-test-model-bf561e/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T15:36:21Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"1f7ed21a-afcf-4dca-a274-c5db7328454c","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1XlPl7UqZUvfoQwvx_hgeifOqBV9dwBIIv4B945hJxhACwo6ngjjnL7b5GqDL"}
{"level":"debug","ts":"2026-07-09T15:36:21Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"1f7ed21a-afcf-4dca-a274-c5db7328454c","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-bf561e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1XlPl7UqZUvfoQwvx_hgeifOqBV9dwBIIv4B945hJxhACwo6ngjjnL7b5GqDL\"}"}
{"level":"debug","ts":"2026-07-09T15:36:21Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"1f7ed21a-afcf-4dca-a274-c5db7328454c","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-bf561e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"1462175f-75e5-4f57-9cc8-8286ce94a240","keyName":"e2e-rate-a-a8872e","subscription":"e2e-rate-iso-a-a8872e","tenant":"e2e-shared-a-bf561e","userId":"1462175f-75e5-4f57-9cc8-8286ce94a240","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T15:36:21Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"1f7ed21a-afcf-4dca-a274-c5db7328454c","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-bf561e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-bf561e/rate-test-model-bf561e\",\"requestedSubscription\":\"e2e-rate-iso-a-a8872e\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-09T15:36:21Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"1f7ed21a-afcf-4dca-a274-c5db7328454c","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-bf561e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-bf561e","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-a8872e","namespace":"ai-tenant-e2e-shared-a-bf561e","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-09T15:36:21Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"1f7ed21a-afcf-4dca-a274-c5db7328454c","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T15:36:21Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1f7ed21a-afcf-4dca-a274-c5db7328454c","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T15:36:21Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1f7ed21a-afcf-4dca-a274-c5db7328454c","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T15:36:21Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1f7ed21a-afcf-4dca-a274-c5db7328454c","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T15:36:21Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1f7ed21a-afcf-4dca-a274-c5db7328454c","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-bf561e/rate-test-model-bf561e\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T15:36:21Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1f7ed21a-afcf-4dca-a274-c5db7328454c","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T15:36:21Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1f7ed21a-afcf-4dca-a274-c5db7328454c","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T15:36:21Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1f7ed21a-afcf-4dca-a274-c5db7328454c","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-a8872e"}
{"level":"debug","ts":"2026-07-09T15:36:21Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1f7ed21a-afcf-4dca-a274-c5db7328454c","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"1462175f-75e5-4f57-9cc8-8286ce94a240","keyName":"e2e-rate-a-a8872e","selected_subscription":"e2e-rate-iso-a-a8872e","selected_subscription_key":"ai-tenant-e2e-shared-a-bf561e/e2e-rate-iso-a-a8872e@ai-tenant-e2e-shared-a-bf561e/rate-test-model-bf561e","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-bf561e","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-a8872e","namespace":"ai-tenant-e2e-shared-a-bf561e","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-09T15:36:21Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1f7ed21a-afcf-4dca-a274-c5db7328454c","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T15:36:21Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1f7ed21a-afcf-4dca-a274-c5db7328454c","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T15:36:22Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e7e6fc6d-e806-4910-b028-9eb627ff8ff7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.8:57180","PortSpecifier":{"PortValue":57180}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.37:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"e7e6fc6d-e806-4910-b028-9eb627ff8ff7","method":"POST","path":"/ai-tenant-e2e-shared-a-bf561e/rate-test-model-bf561e/v1/completions","host":"e2e-shared-a-bf561e.apps.816cbb1a-c3a9-4178-8da2-86e43f1f7dee.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T15:36:22Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e7e6fc6d-e806-4910-b028-9eb627ff8ff7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.8:57180","PortSpecifier":{"PortValue":57180}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.37:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783611382,"nanos":824531297},"http":{"id":"e7e6fc6d-e806-4910-b028-9eb627ff8ff7","method":"POST","headers":{":authority":"e2e-shared-a-bf561e.apps.816cbb1a-c3a9-4178-8da2-86e43f1f7dee.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-bf561e/rate-test-model-bf561e/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T15:36:22Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"e7e6fc6d-e806-4910-b028-9eb627ff8ff7","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1XlPl7UqZUvfoQwvx_hgeifOqBV9dwBIIv4B945hJxhACwo6ngjjnL7b5GqDL"}
{"level":"debug","ts":"2026-07-09T15:36:22Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"e7e6fc6d-e806-4910-b028-9eb627ff8ff7","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-bf561e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1XlPl7UqZUvfoQwvx_hgeifOqBV9dwBIIv4B945hJxhACwo6ngjjnL7b5GqDL\"}"}
{"level":"debug","ts":"2026-07-09T15:36:22Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"e7e6fc6d-e806-4910-b028-9eb627ff8ff7","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-bf561e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"1462175f-75e5-4f57-9cc8-8286ce94a240","keyName":"e2e-rate-a-a8872e","subscription":"e2e-rate-iso-a-a8872e","tenant":"e2e-shared-a-bf561e","userId":"1462175f-75e5-4f57-9cc8-8286ce94a240","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T15:36:22Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"e7e6fc6d-e806-4910-b028-9eb627ff8ff7","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-bf561e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-bf561e/rate-test-model-bf561e\",\"requestedSubscription\":\"e2e-rate-iso-a-a8872e\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-09T15:36:22Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"e7e6fc6d-e806-4910-b028-9eb627ff8ff7","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-bf561e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-bf561e","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-a8872e","namespace":"ai-tenant-e2e-shared-a-bf561e","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-09T15:36:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"e7e6fc6d-e806-4910-b028-9eb627ff8ff7","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T15:36:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e7e6fc6d-e806-4910-b028-9eb627ff8ff7","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T15:36:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e7e6fc6d-e806-4910-b028-9eb627ff8ff7","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T15:36:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e7e6fc6d-e806-4910-b028-9eb627ff8ff7","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-bf561e/rate-test-model-bf561e\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T15:36:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e7e6fc6d-e806-4910-b028-9eb627ff8ff7","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T15:36:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e7e6fc6d-e806-4910-b028-9eb627ff8ff7","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-a8872e"}
{"level":"debug","ts":"2026-07-09T15:36:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e7e6fc6d-e806-4910-b028-9eb627ff8ff7","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T15:36:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e7e6fc6d-e806-4910-b028-9eb627ff8ff7","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T15:36:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e7e6fc6d-e806-4910-b028-9eb627ff8ff7","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"1462175f-75e5-4f57-9cc8-8286ce94a240","keyName":"e2e-rate-a-a8872e","selected_subscription":"e2e-rate-iso-a-a8872e","selected_subscription_key":"ai-tenant-e2e-shared-a-bf561e/e2e-rate-iso-a-a8872e@ai-tenant-e2e-shared-a-bf561e/rate-test-model-bf561e","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-bf561e","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-a8872e","namespace":"ai-tenant-e2e-shared-a-bf561e","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-09T15:36:22Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e7e6fc6d-e806-4910-b028-9eb627ff8ff7","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T15:36:22Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e7e6fc6d-e806-4910-b028-9eb627ff8ff7","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T15:36:23Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8bb0046b-4cf3-4a3e-b643-36003f615c9e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.8:57194","PortSpecifier":{"PortValue":57194}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.37:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"8bb0046b-4cf3-4a3e-b643-36003f615c9e","method":"POST","path":"/ai-tenant-e2e-shared-a-bf561e/rate-test-model-bf561e/v1/completions","host":"e2e-shared-a-bf561e.apps.816cbb1a-c3a9-4178-8da2-86e43f1f7dee.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T15:36:23Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8bb0046b-4cf3-4a3e-b643-36003f615c9e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.8:57194","PortSpecifier":{"PortValue":57194}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.37:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783611383,"nanos":861611642},"http":{"id":"8bb0046b-4cf3-4a3e-b643-36003f615c9e","method":"POST","headers":{":authority":"e2e-shared-a-bf561e.apps.816cbb1a-c3a9-4178-8da2-86e43f1f7dee.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-bf561e/rate-test-model-bf561e/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T15:36:23Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"8bb0046b-4cf3-4a3e-b643-36003f615c9e","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1XlPl7UqZUvfoQwvx_hgeifOqBV9dwBIIv4B945hJxhACwo6ngjjnL7b5GqDL"}
{"level":"debug","ts":"2026-07-09T15:36:23Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"8bb0046b-4cf3-4a3e-b643-36003f615c9e","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-bf561e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1XlPl7UqZUvfoQwvx_hgeifOqBV9dwBIIv4B945hJxhACwo6ngjjnL7b5GqDL\"}"}
{"level":"debug","ts":"2026-07-09T15:36:23Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"8bb0046b-4cf3-4a3e-b643-36003f615c9e","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-bf561e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"1462175f-75e5-4f57-9cc8-8286ce94a240","keyName":"e2e-rate-a-a8872e","subscription":"e2e-rate-iso-a-a8872e","tenant":"e2e-shared-a-bf561e","userId":"1462175f-75e5-4f57-9cc8-8286ce94a240","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T15:36:23Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"8bb0046b-4cf3-4a3e-b643-36003f615c9e","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-bf561e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-bf561e/rate-test-model-bf561e\",\"requestedSubscription\":\"e2e-rate-iso-a-a8872e\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-09T15:36:23Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"8bb0046b-4cf3-4a3e-b643-36003f615c9e","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-bf561e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-bf561e","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-a8872e","namespace":"ai-tenant-e2e-shared-a-bf561e","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-09T15:36:23Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"8bb0046b-4cf3-4a3e-b643-36003f615c9e","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T15:36:23Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8bb0046b-4cf3-4a3e-b643-36003f615c9e","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T15:36:23Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8bb0046b-4cf3-4a3e-b643-36003f615c9e","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T15:36:23Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8bb0046b-4cf3-4a3e-b643-36003f615c9e","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T15:36:23Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8bb0046b-4cf3-4a3e-b643-36003f615c9e","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-bf561e/rate-test-model-bf561e\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T15:36:23Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8bb0046b-4cf3-4a3e-b643-36003f615c9e","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T15:36:23Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8bb0046b-4cf3-4a3e-b643-36003f615c9e","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-a8872e"}
{"level":"debug","ts":"2026-07-09T15:36:23Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8bb0046b-4cf3-4a3e-b643-36003f615c9e","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T15:36:23Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8bb0046b-4cf3-4a3e-b643-36003f615c9e","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"1462175f-75e5-4f57-9cc8-8286ce94a240","keyName":"e2e-rate-a-a8872e","selected_subscription":"e2e-rate-iso-a-a8872e","selected_subscription_key":"ai-tenant-e2e-shared-a-bf561e/e2e-rate-iso-a-a8872e@ai-tenant-e2e-shared-a-bf561e/rate-test-model-bf561e","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-bf561e","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-a8872e","namespace":"ai-tenant-e2e-shared-a-bf561e","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-09T15:36:23Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8bb0046b-4cf3-4a3e-b643-36003f615c9e","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T15:36:23Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8bb0046b-4cf3-4a3e-b643-36003f615c9e","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T15:36:24Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"dbcffc3b-2d51-400b-8bd1-b522f1a98004","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.8:57206","PortSpecifier":{"PortValue":57206}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.37:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"dbcffc3b-2d51-400b-8bd1-b522f1a98004","method":"POST","path":"/ai-tenant-e2e-shared-a-bf561e/rate-test-model-bf561e/v1/completions","host":"e2e-shared-a-bf561e.apps.816cbb1a-c3a9-4178-8da2-86e43f1f7dee.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T15:36:24Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"dbcffc3b-2d51-400b-8bd1-b522f1a98004","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.8:57206","PortSpecifier":{"PortValue":57206}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.37:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783611384,"nanos":897514619},"http":{"id":"dbcffc3b-2d51-400b-8bd1-b522f1a98004","method":"POST","headers":{":authority":"e2e-shared-a-bf561e.apps.816cbb1a-c3a9-4178-8da2-86e43f1f7dee.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-bf561e/rate-test-model-bf561e/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T15:36:24Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"dbcffc3b-2d51-400b-8bd1-b522f1a98004","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1XlPl7UqZUvfoQwvx_hgeifOqBV9dwBIIv4B945hJxhACwo6ngjjnL7b5GqDL"}
{"level":"debug","ts":"2026-07-09T15:36:24Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"dbcffc3b-2d51-400b-8bd1-b522f1a98004","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-bf561e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1XlPl7UqZUvfoQwvx_hgeifOqBV9dwBIIv4B945hJxhACwo6ngjjnL7b5GqDL\"}"}
{"level":"debug","ts":"2026-07-09T15:36:24Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"dbcffc3b-2d51-400b-8bd1-b522f1a98004","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-bf561e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"1462175f-75e5-4f57-9cc8-8286ce94a240","keyName":"e2e-rate-a-a8872e","subscription":"e2e-rate-iso-a-a8872e","tenant":"e2e-shared-a-bf561e","userId":"1462175f-75e5-4f57-9cc8-8286ce94a240","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T15:36:24Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"dbcffc3b-2d51-400b-8bd1-b522f1a98004","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-bf561e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-bf561e/rate-test-model-bf561e\",\"requestedSubscription\":\"e2e-rate-iso-a-a8872e\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-09T15:36:24Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"dbcffc3b-2d51-400b-8bd1-b522f1a98004","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-bf561e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-bf561e","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-a8872e","namespace":"ai-tenant-e2e-shared-a-bf561e","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-09T15:36:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"dbcffc3b-2d51-400b-8bd1-b522f1a98004","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T15:36:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"dbcffc3b-2d51-400b-8bd1-b522f1a98004","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T15:36:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"dbcffc3b-2d51-400b-8bd1-b522f1a98004","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T15:36:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"dbcffc3b-2d51-400b-8bd1-b522f1a98004","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T15:36:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"dbcffc3b-2d51-400b-8bd1-b522f1a98004","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-bf561e/rate-test-model-bf561e\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T15:36:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"dbcffc3b-2d51-400b-8bd1-b522f1a98004","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-a8872e"}
{"level":"debug","ts":"2026-07-09T15:36:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"dbcffc3b-2d51-400b-8bd1-b522f1a98004","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T15:36:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"dbcffc3b-2d51-400b-8bd1-b522f1a98004","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T15:36:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"dbcffc3b-2d51-400b-8bd1-b522f1a98004","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"1462175f-75e5-4f57-9cc8-8286ce94a240","keyName":"e2e-rate-a-a8872e","selected_subscription":"e2e-rate-iso-a-a8872e","selected_subscription_key":"ai-tenant-e2e-shared-a-bf561e/e2e-rate-iso-a-a8872e@ai-tenant-e2e-shared-a-bf561e/rate-test-model-bf561e","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-bf561e","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-a8872e","namespace":"ai-tenant-e2e-shared-a-bf561e","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-09T15:36:24Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"dbcffc3b-2d51-400b-8bd1-b522f1a98004","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T15:36:24Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"dbcffc3b-2d51-400b-8bd1-b522f1a98004","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T15:36:25Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7830b75e-1cfb-4521-8029-641c1d176767","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.8:57216","PortSpecifier":{"PortValue":57216}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.37:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"7830b75e-1cfb-4521-8029-641c1d176767","method":"POST","path":"/ai-tenant-e2e-shared-a-bf561e/rate-test-model-bf561e/v1/completions","host":"e2e-shared-a-bf561e.apps.816cbb1a-c3a9-4178-8da2-86e43f1f7dee.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T15:36:25Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7830b75e-1cfb-4521-8029-641c1d176767","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.8:57216","PortSpecifier":{"PortValue":57216}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.37:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783611385,"nanos":930594825},"http":{"id":"7830b75e-1cfb-4521-8029-641c1d176767","method":"POST","headers":{":authority":"e2e-shared-a-bf561e.apps.816cbb1a-c3a9-4178-8da2-86e43f1f7dee.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-bf561e/rate-test-model-bf561e/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T15:36:25Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"7830b75e-1cfb-4521-8029-641c1d176767","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1XlPl7UqZUvfoQwvx_hgeifOqBV9dwBIIv4B945hJxhACwo6ngjjnL7b5GqDL"}
{"level":"debug","ts":"2026-07-09T15:36:25Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"7830b75e-1cfb-4521-8029-641c1d176767","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-bf561e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1XlPl7UqZUvfoQwvx_hgeifOqBV9dwBIIv4B945hJxhACwo6ngjjnL7b5GqDL\"}"}
{"level":"debug","ts":"2026-07-09T15:36:25Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"7830b75e-1cfb-4521-8029-641c1d176767","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-bf561e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"1462175f-75e5-4f57-9cc8-8286ce94a240","keyName":"e2e-rate-a-a8872e","subscription":"e2e-rate-iso-a-a8872e","tenant":"e2e-shared-a-bf561e","userId":"1462175f-75e5-4f57-9cc8-8286ce94a240","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T15:36:25Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"7830b75e-1cfb-4521-8029-641c1d176767","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-bf561e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-bf561e/rate-test-model-bf561e\",\"requestedSubscription\":\"e2e-rate-iso-a-a8872e\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-09T15:36:25Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"7830b75e-1cfb-4521-8029-641c1d176767","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-bf561e.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-bf561e","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-a8872e","namespace":"ai-tenant-e2e-shared-a-bf561e","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-09T15:36:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"7830b75e-1cfb-4521-8029-641c1d176767","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T15:36:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7830b75e-1cfb-4521-8029-641c1d176767","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T15:36:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7830b75e-1cfb-4521-8029-641c1d176767","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T15:36:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7830b75e-1cfb-4521-8029-641c1d176767","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T15:36:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7830b75e-1cfb-4521-8029-641c1d176767","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-bf561e/rate-test-model-bf561e\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T15:36:25Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7830b75e-1cfb-4521-8029-641c1d176767","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T15:36:25Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7830b75e-1cfb-4521-8029-641c1d176767","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T15:36:25Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7830b75e-1cfb-4521-8029-641c1d176767","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-a8872e"}
{"level":"debug","ts":"2026-07-09T15:36:25Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7830b75e-1cfb-4521-8029-641c1d176767","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"1462175f-75e5-4f57-9cc8-8286ce94a240","keyName":"e2e-rate-a-a8872e","selected_subscription":"e2e-rate-iso-a-a8872e","selected_subscription_key":"ai-tenant-e2e-shared-a-bf561e/e2e-rate-iso-a-a8872e@ai-tenant-e2e-shared-a-bf561e/rate-test-model-bf561e","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-bf561e","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-a8872e","namespace":"ai-tenant-e2e-shared-a-bf561e","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-09T15:36:25Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7830b75e-1cfb-4521-8029-641c1d176767","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T15:36:25Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7830b75e-1cfb-4521-8029-641c1d176767","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T15:36:25Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"462dbbc0-5927-4e50-a700-c7d55a93e8d4","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.8:42316","PortSpecifier":{"PortValue":42316}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.65:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"462dbbc0-5927-4e50-a700-c7d55a93e8d4","method":"POST","path":"/ai-tenant-e2e-shared-b-497419/rate-test-model-497419/v1/completions","host":"e2e-shared-b-497419.apps.816cbb1a-c3a9-4178-8da2-86e43f1f7dee.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-09T15:36:25Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"462dbbc0-5927-4e50-a700-c7d55a93e8d4","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.8:42316","PortSpecifier":{"PortValue":42316}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.65:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783611385,"nanos":965410118},"http":{"id":"462dbbc0-5927-4e50-a700-c7d55a93e8d4","method":"POST","headers":{":authority":"e2e-shared-b-497419.apps.816cbb1a-c3a9-4178-8da2-86e43f1f7dee.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-b-497419/rate-test-model-497419/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T15:36:25Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"462dbbc0-5927-4e50-a700-c7d55a93e8d4","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-ri4lXCjBI5K3BhLp_6NsXR3KfzPBjj1W1x2zFy0ZPA0kGZMLJmZNkGSCRKKO"}
{"level":"debug","ts":"2026-07-09T15:36:25Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"462dbbc0-5927-4e50-a700-c7d55a93e8d4","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-b-497419.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-ri4lXCjBI5K3BhLp_6NsXR3KfzPBjj1W1x2zFy0ZPA0kGZMLJmZNkGSCRKKO\"}"}
{"level":"debug","ts":"2026-07-09T15:36:25Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"462dbbc0-5927-4e50-a700-c7d55a93e8d4","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-497419.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"3d76a113-3c0a-42e7-b349-875e2da3c8ab","keyName":"e2e-rate-b-a8872e","subscription":"e2e-rate-iso-b-a8872e","tenant":"e2e-shared-b-497419","userId":"3d76a113-3c0a-42e7-b349-875e2da3c8ab","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-09T15:36:25Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"462dbbc0-5927-4e50-a700-c7d55a93e8d4","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-b-497419.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-b-497419/rate-test-model-497419\",\"requestedSubscription\":\"e2e-rate-iso-b-a8872e\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-09T15:36:25Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"462dbbc0-5927-4e50-a700-c7d55a93e8d4","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-497419.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-497419","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-a8872e","namespace":"ai-tenant-e2e-shared-b-497419","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-09T15:36:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"462dbbc0-5927-4e50-a700-c7d55a93e8d4","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-09T15:36:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"462dbbc0-5927-4e50-a700-c7d55a93e8d4","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T15:36:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"462dbbc0-5927-4e50-a700-c7d55a93e8d4","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T15:36:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"462dbbc0-5927-4e50-a700-c7d55a93e8d4","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-497419/rate-test-model-497419\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T15:36:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"462dbbc0-5927-4e50-a700-c7d55a93e8d4","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-09T15:36:25Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"462dbbc0-5927-4e50-a700-c7d55a93e8d4","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-09T15:36:25Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"462dbbc0-5927-4e50-a700-c7d55a93e8d4","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-09T15:36:25Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"462dbbc0-5927-4e50-a700-c7d55a93e8d4","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-b-a8872e"}
{"level":"debug","ts":"2026-07-09T15:36:25Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"462dbbc0-5927-4e50-a700-c7d55a93e8d4","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"3d76a113-3c0a-42e7-b349-875e2da3c8ab","keyName":"e2e-rate-b-a8872e","selected_subscription":"e2e-rate-iso-b-a8872e","selected_subscription_key":"ai-tenant-e2e-shared-b-497419/e2e-rate-iso-b-a8872e@ai-tenant-e2e-shared-b-497419/rate-test-model-497419","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-497419","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-a8872e","namespace":"ai-tenant-e2e-shared-b-497419","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-09T15:36:25Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"462dbbc0-5927-4e50-a700-c7d55a93e8d4","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-09T15:36:25Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"462dbbc0-5927-4e50-a700-c7d55a93e8d4","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-09T15:36:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/795fdb83fea48c1d43e15ceaedfbb230725adb7e498e6d8cf0f70c1cc216b1c9"}
{"level":"info","ts":"2026-07-09T15:36:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/5d7d657d71b0fc9cb2f5917b3127cb6115d20b7c1a197b432bbf6b75ae13a5c4"}
{"level":"info","ts":"2026-07-09T15:36:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/14304f2900ac8905c677ee56cab3ef81b96f90e60071647e8f874f4b5ea85fe8"}
{"level":"info","ts":"2026-07-09T15:36:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/96c117274f08d9e7e3ba0030a47aaea5d2c001b650f564acc423b44a972edc71"}
{"level":"info","ts":"2026-07-09T15:36:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/2029432bfc4997fa122e3818da16e0a49c98392c7664ff1311671649ba28fb1e"}
{"level":"info","ts":"2026-07-09T15:36:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/e555e8b920633f9e4449473cbb227183f87cea8ab777c3e2e34483afed38679a"}
{"level":"info","ts":"2026-07-09T15:36:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/9cbfbe53ce2fd4a9b514c77832b2872c7b804af0ae596fc03b45723a152b7eda"}
{"level":"info","ts":"2026-07-09T15:36:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/4afb2c3c2feb41dff707127a88ccdc366ca6f3fc55b3988b1ba567dc5ce5313a"}
{"level":"info","ts":"2026-07-09T15:36:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/4c300c052ac4fd6938cef110c4213f130c42defb7745fcf982a32c044d791fa6"}
{"level":"info","ts":"2026-07-09T15:36:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/7fb8f330cf2e87575566162355685096b3459bc5bea0d3b52e020c3b68908e8f"}
{"level":"info","ts":"2026-07-09T15:36:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/4c400f837bcabb582b18d87f3de003fbfe150bec7a6642d0f3923289f3384eea"}
{"level":"info","ts":"2026-07-09T15:36:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/12b645b9aad06e871b008c5fdf114cdb55b9d68aa58351eaa70aefd4c4586a11"}
{"level":"info","ts":"2026-07-09T15:36:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/2ed220395ed279bad022bc5d8791c26dc8fa8bd57b7ab11c056ead3de2606e98"}
{"level":"info","ts":"2026-07-09T15:36:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/7da18c45296d4e760ec3628f616fcb9bc835030fcfe46372b9bba4b6e4209bd6"}
{"level":"info","ts":"2026-07-09T15:36:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/f3a15a315e24d8d6624058b1341c21911264514849990c03a1506b63318027e6"}
{"level":"info","ts":"2026-07-09T15:36:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/fd2ef392fe6b93842a2ebd2a981c8252d36c7abf2a53385d8d78395500a95476"}
{"level":"info","ts":"2026-07-09T15:36:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/a6ae7d7572377d1195f819f319e9d3490e45b035fcd34cbced5dd0b544d017e9"}
{"level":"info","ts":"2026-07-09T15:36:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/b26f03d1657cfdc3d80c3577d9920e2d2fdeb8be3c44a9e6a628daa932ed55df"}
{"level":"info","ts":"2026-07-09T15:36:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/1e6fc99fe7cc8411a3c02a2fe5b0ad77d3837b94bc64b178dd8885e76757487a"}
{"level":"info","ts":"2026-07-09T15:36:52Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/3bf36d6fa9c36237450129e3a000b1e89a39a305ce2d0f06b345196ab160711e"}
{"level":"info","ts":"2026-07-09T15:37:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/7fef3087cc5da3715f76063c79d44c91c20a31616698f1ee16d92c1187beb2b2"}
{"level":"info","ts":"2026-07-09T15:37:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/d5504fe62b8e55ebf23f874bf846c88a4080911486ee2076f2a0ebc2d8e7e6c5"}
{"level":"info","ts":"2026-07-09T15:37:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/dfea2a47467717d4d4b0a26e5cec25323b54ad1ee1aa724dd7350b62f3507460"}
{"level":"info","ts":"2026-07-09T15:37:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/fc396a42c65aecc7f96a92535c05dee18fa5491f77b5ee3175b02c22f9814839"}