{"level":"debug","ts":"2026-07-26T16:24:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8ae34cdd-3223-4d23-a2cf-a3f02b450921","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-a68180"}
{"level":"debug","ts":"2026-07-26T16:24:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8ae34cdd-3223-4d23-a2cf-a3f02b450921","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-26T16:24:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8ae34cdd-3223-4d23-a2cf-a3f02b450921","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"46514efa-6c21-4d56-8e68-b90b6709aeff","keyName":"e2e-rate-a-a68180","selected_subscription":"e2e-rate-iso-a-a68180","selected_subscription_key":"ai-tenant-e2e-shared-a-aadfb2/e2e-rate-iso-a-a68180@ai-tenant-e2e-shared-a-aadfb2/rate-test-model-aadfb2","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-aadfb2/models/facebook/opt-125m","name":"rate-test-model-aadfb2","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-a68180","namespace":"ai-tenant-e2e-shared-a-aadfb2","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-aadfb2/rate-test-model-aadfb2"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-26T16:24:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8ae34cdd-3223-4d23-a2cf-a3f02b450921","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-26T16:24:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8ae34cdd-3223-4d23-a2cf-a3f02b450921","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-26T16:24:28Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a48d8721-a914-4e51-903a-9508ed0c338b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:38502","PortSpecifier":{"PortValue":38502}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.68:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"a48d8721-a914-4e51-903a-9508ed0c338b","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-aadfb2.apps.4c5817f4-713b-4eab-97fd-3d8252b1e299.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-26T16:24:28Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a48d8721-a914-4e51-903a-9508ed0c338b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:38502","PortSpecifier":{"PortValue":38502}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.68:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785083068,"nanos":545917485},"http":{"id":"a48d8721-a914-4e51-903a-9508ed0c338b","method":"POST","headers":{":authority":"e2e-shared-a-aadfb2.apps.4c5817f4-713b-4eab-97fd-3d8252b1e299.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-26T16:24:28Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"a48d8721-a914-4e51-903a-9508ed0c338b","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-26T16:24:28Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"a48d8721-a914-4e51-903a-9508ed0c338b","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"152070b3-08f0-451d-a549-25cf7f44a8bd","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=365ca425-c8f4-4347-a44f-32434e7dc959"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/3d8252b1e299"]}}
{"level":"debug","ts":"2026-07-26T16:24:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"a48d8721-a914-4e51-903a-9508ed0c338b","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/3d8252b1e299"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=365ca425-c8f4-4347-a44f-32434e7dc959"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"152070b3-08f0-451d-a549-25cf7f44a8bd","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"93bcb7e6deb1792c99da6f547ea6a82682f26381087d59cf27e14f6c966952f8"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.68:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-aadfb2.apps.4c5817f4-713b-4eab-97fd-3d8252b1e299.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-26T16:24:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a48d8721-a914-4e51-903a-9508ed0c338b","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-26T16:24:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a48d8721-a914-4e51-903a-9508ed0c338b","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-26T16:24:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a48d8721-a914-4e51-903a-9508ed0c338b","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-aadfb2/rate-test-model-aadfb2\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-aadfb2/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-26T16:24:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"a48d8721-a914-4e51-903a-9508ed0c338b","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-26T16:24:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a48d8721-a914-4e51-903a-9508ed0c338b","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-26T16:24:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a48d8721-a914-4e51-903a-9508ed0c338b","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-26T16:24:28Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a48d8721-a914-4e51-903a-9508ed0c338b","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-26T16:24:28Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a48d8721-a914-4e51-903a-9508ed0c338b","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-26T16:24:28Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"cfd656ab-37b2-47b1-8bbb-df967ebfcd3a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:50138","PortSpecifier":{"PortValue":50138}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.69:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"cfd656ab-37b2-47b1-8bbb-df967ebfcd3a","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-e0208c.apps.4c5817f4-713b-4eab-97fd-3d8252b1e299.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-26T16:24:28Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"cfd656ab-37b2-47b1-8bbb-df967ebfcd3a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:50138","PortSpecifier":{"PortValue":50138}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.69:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785083068,"nanos":580242241},"http":{"id":"cfd656ab-37b2-47b1-8bbb-df967ebfcd3a","method":"POST","headers":{":authority":"e2e-shared-b-e0208c.apps.4c5817f4-713b-4eab-97fd-3d8252b1e299.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-26T16:24:28Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"cfd656ab-37b2-47b1-8bbb-df967ebfcd3a","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-26T16:24:28Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"cfd656ab-37b2-47b1-8bbb-df967ebfcd3a","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"152070b3-08f0-451d-a549-25cf7f44a8bd","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=365ca425-c8f4-4347-a44f-32434e7dc959"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/3d8252b1e299"]}}
{"level":"debug","ts":"2026-07-26T16:24:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"cfd656ab-37b2-47b1-8bbb-df967ebfcd3a","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/3d8252b1e299"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=365ca425-c8f4-4347-a44f-32434e7dc959"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"152070b3-08f0-451d-a549-25cf7f44a8bd","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"da97f83efb7400aeb0140dddf5d5d329b3c9fdcf3cfeb2748dd83a420646c9e0"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.69:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-e0208c.apps.4c5817f4-713b-4eab-97fd-3d8252b1e299.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-26T16:24:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cfd656ab-37b2-47b1-8bbb-df967ebfcd3a","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-26T16:24:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cfd656ab-37b2-47b1-8bbb-df967ebfcd3a","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-26T16:24:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cfd656ab-37b2-47b1-8bbb-df967ebfcd3a","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-e0208c/rate-test-model-e0208c\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-e0208c/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-26T16:24:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"cfd656ab-37b2-47b1-8bbb-df967ebfcd3a","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-26T16:24:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cfd656ab-37b2-47b1-8bbb-df967ebfcd3a","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-26T16:24:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cfd656ab-37b2-47b1-8bbb-df967ebfcd3a","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-26T16:24:28Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"cfd656ab-37b2-47b1-8bbb-df967ebfcd3a","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-26T16:24:28Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"cfd656ab-37b2-47b1-8bbb-df967ebfcd3a","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-26T16:24:28Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"479c64b8-593c-48f5-8bde-b3c5595fb389","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:38516","PortSpecifier":{"PortValue":38516}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.68:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"479c64b8-593c-48f5-8bde-b3c5595fb389","method":"POST","path":"/ai-tenant-e2e-shared-a-aadfb2/rate-test-model-aadfb2/v1/completions","host":"e2e-shared-a-aadfb2.apps.4c5817f4-713b-4eab-97fd-3d8252b1e299.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-26T16:24:28Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"479c64b8-593c-48f5-8bde-b3c5595fb389","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:38516","PortSpecifier":{"PortValue":38516}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.68:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785083068,"nanos":618900817},"http":{"id":"479c64b8-593c-48f5-8bde-b3c5595fb389","method":"POST","headers":{":authority":"e2e-shared-a-aadfb2.apps.4c5817f4-713b-4eab-97fd-3d8252b1e299.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-aadfb2/rate-test-model-aadfb2/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-26T16:24:28Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"479c64b8-593c-48f5-8bde-b3c5595fb389","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-ptrFhfyYQMhz2aOc_evDnsXVIxR754z0nWgRK9pW0KFUu1LfmHAnJzf8hRiS"}
{"level":"debug","ts":"2026-07-26T16:24:28Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"479c64b8-593c-48f5-8bde-b3c5595fb389","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-aadfb2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-ptrFhfyYQMhz2aOc_evDnsXVIxR754z0nWgRK9pW0KFUu1LfmHAnJzf8hRiS\"}"}
{"level":"debug","ts":"2026-07-26T16:24:28Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"479c64b8-593c-48f5-8bde-b3c5595fb389","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-aadfb2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"e16db9ca-e07d-41f8-b839-aadecb4bfca5","keyName":"e2e-rate-a-1ba5b8","subscription":"e2e-rate-iso-a-1ba5b8","tenant":"e2e-shared-a-aadfb2","userId":"e16db9ca-e07d-41f8-b839-aadecb4bfca5","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-26T16:24:28Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"479c64b8-593c-48f5-8bde-b3c5595fb389","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-aadfb2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-aadfb2/rate-test-model-aadfb2\",\"requestedSubscription\":\"e2e-rate-iso-a-1ba5b8\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-26T16:24:28Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"479c64b8-593c-48f5-8bde-b3c5595fb389","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-aadfb2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-aadfb2/models/facebook/opt-125m","name":"rate-test-model-aadfb2","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-1ba5b8","namespace":"ai-tenant-e2e-shared-a-aadfb2","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-aadfb2/rate-test-model-aadfb2"}}
{"level":"debug","ts":"2026-07-26T16:24:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"479c64b8-593c-48f5-8bde-b3c5595fb389","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-26T16:24:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"479c64b8-593c-48f5-8bde-b3c5595fb389","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-26T16:24:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"479c64b8-593c-48f5-8bde-b3c5595fb389","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-aadfb2/rate-test-model-aadfb2\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-aadfb2/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-26T16:24:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"479c64b8-593c-48f5-8bde-b3c5595fb389","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-26T16:24:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"479c64b8-593c-48f5-8bde-b3c5595fb389","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-26T16:24:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"479c64b8-593c-48f5-8bde-b3c5595fb389","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-26T16:24:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"479c64b8-593c-48f5-8bde-b3c5595fb389","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-1ba5b8"}
{"level":"debug","ts":"2026-07-26T16:24:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"479c64b8-593c-48f5-8bde-b3c5595fb389","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-26T16:24:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"479c64b8-593c-48f5-8bde-b3c5595fb389","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"e16db9ca-e07d-41f8-b839-aadecb4bfca5","keyName":"e2e-rate-a-1ba5b8","selected_subscription":"e2e-rate-iso-a-1ba5b8","selected_subscription_key":"ai-tenant-e2e-shared-a-aadfb2/e2e-rate-iso-a-1ba5b8@ai-tenant-e2e-shared-a-aadfb2/rate-test-model-aadfb2","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-aadfb2/models/facebook/opt-125m","name":"rate-test-model-aadfb2","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-1ba5b8","namespace":"ai-tenant-e2e-shared-a-aadfb2","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-aadfb2/rate-test-model-aadfb2"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-26T16:24:28Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"479c64b8-593c-48f5-8bde-b3c5595fb389","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-26T16:24:28Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"479c64b8-593c-48f5-8bde-b3c5595fb389","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-26T16:24:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"fd476510-f4d3-4f60-b227-99bd825e2869","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:38518","PortSpecifier":{"PortValue":38518}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.68:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"fd476510-f4d3-4f60-b227-99bd825e2869","method":"POST","path":"/ai-tenant-e2e-shared-a-aadfb2/rate-test-model-aadfb2/v1/completions","host":"e2e-shared-a-aadfb2.apps.4c5817f4-713b-4eab-97fd-3d8252b1e299.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-26T16:24:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"fd476510-f4d3-4f60-b227-99bd825e2869","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:38518","PortSpecifier":{"PortValue":38518}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.68:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785083069,"nanos":657232728},"http":{"id":"fd476510-f4d3-4f60-b227-99bd825e2869","method":"POST","headers":{":authority":"e2e-shared-a-aadfb2.apps.4c5817f4-713b-4eab-97fd-3d8252b1e299.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-aadfb2/rate-test-model-aadfb2/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-26T16:24:29Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"fd476510-f4d3-4f60-b227-99bd825e2869","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-ptrFhfyYQMhz2aOc_evDnsXVIxR754z0nWgRK9pW0KFUu1LfmHAnJzf8hRiS"}
{"level":"debug","ts":"2026-07-26T16:24:29Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"fd476510-f4d3-4f60-b227-99bd825e2869","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-aadfb2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-ptrFhfyYQMhz2aOc_evDnsXVIxR754z0nWgRK9pW0KFUu1LfmHAnJzf8hRiS\"}"}
{"level":"debug","ts":"2026-07-26T16:24:29Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"fd476510-f4d3-4f60-b227-99bd825e2869","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-aadfb2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"e16db9ca-e07d-41f8-b839-aadecb4bfca5","keyName":"e2e-rate-a-1ba5b8","subscription":"e2e-rate-iso-a-1ba5b8","tenant":"e2e-shared-a-aadfb2","userId":"e16db9ca-e07d-41f8-b839-aadecb4bfca5","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-26T16:24:29Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"fd476510-f4d3-4f60-b227-99bd825e2869","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-aadfb2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-aadfb2/rate-test-model-aadfb2\",\"requestedSubscription\":\"e2e-rate-iso-a-1ba5b8\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-26T16:24:29Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"fd476510-f4d3-4f60-b227-99bd825e2869","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-aadfb2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-aadfb2/models/facebook/opt-125m","name":"rate-test-model-aadfb2","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-1ba5b8","namespace":"ai-tenant-e2e-shared-a-aadfb2","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-aadfb2/rate-test-model-aadfb2"}}
{"level":"debug","ts":"2026-07-26T16:24:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"fd476510-f4d3-4f60-b227-99bd825e2869","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-26T16:24:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fd476510-f4d3-4f60-b227-99bd825e2869","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-26T16:24:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fd476510-f4d3-4f60-b227-99bd825e2869","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-26T16:24:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fd476510-f4d3-4f60-b227-99bd825e2869","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-aadfb2/rate-test-model-aadfb2\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-aadfb2/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-26T16:24:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fd476510-f4d3-4f60-b227-99bd825e2869","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-26T16:24:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"fd476510-f4d3-4f60-b227-99bd825e2869","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-26T16:24:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"fd476510-f4d3-4f60-b227-99bd825e2869","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-1ba5b8"}
{"level":"debug","ts":"2026-07-26T16:24:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"fd476510-f4d3-4f60-b227-99bd825e2869","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-26T16:24:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"fd476510-f4d3-4f60-b227-99bd825e2869","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"e16db9ca-e07d-41f8-b839-aadecb4bfca5","keyName":"e2e-rate-a-1ba5b8","selected_subscription":"e2e-rate-iso-a-1ba5b8","selected_subscription_key":"ai-tenant-e2e-shared-a-aadfb2/e2e-rate-iso-a-1ba5b8@ai-tenant-e2e-shared-a-aadfb2/rate-test-model-aadfb2","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-aadfb2/models/facebook/opt-125m","name":"rate-test-model-aadfb2","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-1ba5b8","namespace":"ai-tenant-e2e-shared-a-aadfb2","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-aadfb2/rate-test-model-aadfb2"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-26T16:24:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"fd476510-f4d3-4f60-b227-99bd825e2869","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-26T16:24:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"fd476510-f4d3-4f60-b227-99bd825e2869","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-26T16:24:30Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3bbbc0e3-05f7-45a1-b102-b55483d710ea","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:38524","PortSpecifier":{"PortValue":38524}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.68:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"3bbbc0e3-05f7-45a1-b102-b55483d710ea","method":"POST","path":"/ai-tenant-e2e-shared-a-aadfb2/rate-test-model-aadfb2/v1/completions","host":"e2e-shared-a-aadfb2.apps.4c5817f4-713b-4eab-97fd-3d8252b1e299.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-26T16:24:30Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3bbbc0e3-05f7-45a1-b102-b55483d710ea","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:38524","PortSpecifier":{"PortValue":38524}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.68:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785083070,"nanos":696467805},"http":{"id":"3bbbc0e3-05f7-45a1-b102-b55483d710ea","method":"POST","headers":{":authority":"e2e-shared-a-aadfb2.apps.4c5817f4-713b-4eab-97fd-3d8252b1e299.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-aadfb2/rate-test-model-aadfb2/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-26T16:24:30Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"3bbbc0e3-05f7-45a1-b102-b55483d710ea","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-ptrFhfyYQMhz2aOc_evDnsXVIxR754z0nWgRK9pW0KFUu1LfmHAnJzf8hRiS"}
{"level":"debug","ts":"2026-07-26T16:24:30Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"3bbbc0e3-05f7-45a1-b102-b55483d710ea","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-aadfb2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-ptrFhfyYQMhz2aOc_evDnsXVIxR754z0nWgRK9pW0KFUu1LfmHAnJzf8hRiS\"}"}
{"level":"debug","ts":"2026-07-26T16:24:30Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"3bbbc0e3-05f7-45a1-b102-b55483d710ea","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-aadfb2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"e16db9ca-e07d-41f8-b839-aadecb4bfca5","keyName":"e2e-rate-a-1ba5b8","subscription":"e2e-rate-iso-a-1ba5b8","tenant":"e2e-shared-a-aadfb2","userId":"e16db9ca-e07d-41f8-b839-aadecb4bfca5","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-26T16:24:30Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"3bbbc0e3-05f7-45a1-b102-b55483d710ea","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-aadfb2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-aadfb2/rate-test-model-aadfb2\",\"requestedSubscription\":\"e2e-rate-iso-a-1ba5b8\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-26T16:24:30Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"3bbbc0e3-05f7-45a1-b102-b55483d710ea","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-aadfb2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-aadfb2/models/facebook/opt-125m","name":"rate-test-model-aadfb2","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-1ba5b8","namespace":"ai-tenant-e2e-shared-a-aadfb2","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-aadfb2/rate-test-model-aadfb2"}}
{"level":"debug","ts":"2026-07-26T16:24:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"3bbbc0e3-05f7-45a1-b102-b55483d710ea","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-26T16:24:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3bbbc0e3-05f7-45a1-b102-b55483d710ea","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-26T16:24:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3bbbc0e3-05f7-45a1-b102-b55483d710ea","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-26T16:24:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3bbbc0e3-05f7-45a1-b102-b55483d710ea","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-26T16:24:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3bbbc0e3-05f7-45a1-b102-b55483d710ea","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-aadfb2/rate-test-model-aadfb2\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-aadfb2/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-26T16:24:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3bbbc0e3-05f7-45a1-b102-b55483d710ea","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-26T16:24:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3bbbc0e3-05f7-45a1-b102-b55483d710ea","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-1ba5b8"}
{"level":"debug","ts":"2026-07-26T16:24:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3bbbc0e3-05f7-45a1-b102-b55483d710ea","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-26T16:24:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3bbbc0e3-05f7-45a1-b102-b55483d710ea","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"e16db9ca-e07d-41f8-b839-aadecb4bfca5","keyName":"e2e-rate-a-1ba5b8","selected_subscription":"e2e-rate-iso-a-1ba5b8","selected_subscription_key":"ai-tenant-e2e-shared-a-aadfb2/e2e-rate-iso-a-1ba5b8@ai-tenant-e2e-shared-a-aadfb2/rate-test-model-aadfb2","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-aadfb2/models/facebook/opt-125m","name":"rate-test-model-aadfb2","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-1ba5b8","namespace":"ai-tenant-e2e-shared-a-aadfb2","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-aadfb2/rate-test-model-aadfb2"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-26T16:24:30Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3bbbc0e3-05f7-45a1-b102-b55483d710ea","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-26T16:24:30Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3bbbc0e3-05f7-45a1-b102-b55483d710ea","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-26T16:24:31Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7c47723c-9bed-4475-8b89-c008ac2b825f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:38526","PortSpecifier":{"PortValue":38526}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.68:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"7c47723c-9bed-4475-8b89-c008ac2b825f","method":"POST","path":"/ai-tenant-e2e-shared-a-aadfb2/rate-test-model-aadfb2/v1/completions","host":"e2e-shared-a-aadfb2.apps.4c5817f4-713b-4eab-97fd-3d8252b1e299.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-26T16:24:31Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7c47723c-9bed-4475-8b89-c008ac2b825f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:38526","PortSpecifier":{"PortValue":38526}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.68:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785083071,"nanos":734077843},"http":{"id":"7c47723c-9bed-4475-8b89-c008ac2b825f","method":"POST","headers":{":authority":"e2e-shared-a-aadfb2.apps.4c5817f4-713b-4eab-97fd-3d8252b1e299.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-aadfb2/rate-test-model-aadfb2/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-26T16:24:31Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"7c47723c-9bed-4475-8b89-c008ac2b825f","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-ptrFhfyYQMhz2aOc_evDnsXVIxR754z0nWgRK9pW0KFUu1LfmHAnJzf8hRiS"}
{"level":"debug","ts":"2026-07-26T16:24:31Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"7c47723c-9bed-4475-8b89-c008ac2b825f","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-aadfb2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-ptrFhfyYQMhz2aOc_evDnsXVIxR754z0nWgRK9pW0KFUu1LfmHAnJzf8hRiS\"}"}
{"level":"debug","ts":"2026-07-26T16:24:31Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"7c47723c-9bed-4475-8b89-c008ac2b825f","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-aadfb2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"e16db9ca-e07d-41f8-b839-aadecb4bfca5","keyName":"e2e-rate-a-1ba5b8","subscription":"e2e-rate-iso-a-1ba5b8","tenant":"e2e-shared-a-aadfb2","userId":"e16db9ca-e07d-41f8-b839-aadecb4bfca5","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-26T16:24:31Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"7c47723c-9bed-4475-8b89-c008ac2b825f","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-aadfb2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-aadfb2/rate-test-model-aadfb2\",\"requestedSubscription\":\"e2e-rate-iso-a-1ba5b8\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-26T16:24:31Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"7c47723c-9bed-4475-8b89-c008ac2b825f","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-aadfb2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-aadfb2/models/facebook/opt-125m","name":"rate-test-model-aadfb2","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-1ba5b8","namespace":"ai-tenant-e2e-shared-a-aadfb2","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-aadfb2/rate-test-model-aadfb2"}}
{"level":"debug","ts":"2026-07-26T16:24:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"7c47723c-9bed-4475-8b89-c008ac2b825f","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-26T16:24:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7c47723c-9bed-4475-8b89-c008ac2b825f","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-26T16:24:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7c47723c-9bed-4475-8b89-c008ac2b825f","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-26T16:24:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7c47723c-9bed-4475-8b89-c008ac2b825f","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-aadfb2/rate-test-model-aadfb2\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-aadfb2/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-26T16:24:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7c47723c-9bed-4475-8b89-c008ac2b825f","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-26T16:24:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7c47723c-9bed-4475-8b89-c008ac2b825f","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-1ba5b8"}
{"level":"debug","ts":"2026-07-26T16:24:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7c47723c-9bed-4475-8b89-c008ac2b825f","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-26T16:24:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7c47723c-9bed-4475-8b89-c008ac2b825f","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-26T16:24:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7c47723c-9bed-4475-8b89-c008ac2b825f","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"e16db9ca-e07d-41f8-b839-aadecb4bfca5","keyName":"e2e-rate-a-1ba5b8","selected_subscription":"e2e-rate-iso-a-1ba5b8","selected_subscription_key":"ai-tenant-e2e-shared-a-aadfb2/e2e-rate-iso-a-1ba5b8@ai-tenant-e2e-shared-a-aadfb2/rate-test-model-aadfb2","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-aadfb2/models/facebook/opt-125m","name":"rate-test-model-aadfb2","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-1ba5b8","namespace":"ai-tenant-e2e-shared-a-aadfb2","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-aadfb2/rate-test-model-aadfb2"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-26T16:24:31Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7c47723c-9bed-4475-8b89-c008ac2b825f","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-26T16:24:31Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7c47723c-9bed-4475-8b89-c008ac2b825f","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-26T16:24:32Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3f21feb3-e014-440f-a16a-fba6870fdcbf","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:38534","PortSpecifier":{"PortValue":38534}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.68:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"3f21feb3-e014-440f-a16a-fba6870fdcbf","method":"POST","path":"/ai-tenant-e2e-shared-a-aadfb2/rate-test-model-aadfb2/v1/completions","host":"e2e-shared-a-aadfb2.apps.4c5817f4-713b-4eab-97fd-3d8252b1e299.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-26T16:24:32Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3f21feb3-e014-440f-a16a-fba6870fdcbf","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:38534","PortSpecifier":{"PortValue":38534}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.68:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785083072,"nanos":771567718},"http":{"id":"3f21feb3-e014-440f-a16a-fba6870fdcbf","method":"POST","headers":{":authority":"e2e-shared-a-aadfb2.apps.4c5817f4-713b-4eab-97fd-3d8252b1e299.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-aadfb2/rate-test-model-aadfb2/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-26T16:24:32Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"3f21feb3-e014-440f-a16a-fba6870fdcbf","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-ptrFhfyYQMhz2aOc_evDnsXVIxR754z0nWgRK9pW0KFUu1LfmHAnJzf8hRiS"}
{"level":"debug","ts":"2026-07-26T16:24:32Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"3f21feb3-e014-440f-a16a-fba6870fdcbf","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-aadfb2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-ptrFhfyYQMhz2aOc_evDnsXVIxR754z0nWgRK9pW0KFUu1LfmHAnJzf8hRiS\"}"}
{"level":"debug","ts":"2026-07-26T16:24:32Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"3f21feb3-e014-440f-a16a-fba6870fdcbf","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-aadfb2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"e16db9ca-e07d-41f8-b839-aadecb4bfca5","keyName":"e2e-rate-a-1ba5b8","subscription":"e2e-rate-iso-a-1ba5b8","tenant":"e2e-shared-a-aadfb2","userId":"e16db9ca-e07d-41f8-b839-aadecb4bfca5","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-26T16:24:32Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"3f21feb3-e014-440f-a16a-fba6870fdcbf","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-aadfb2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-aadfb2/rate-test-model-aadfb2\",\"requestedSubscription\":\"e2e-rate-iso-a-1ba5b8\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-26T16:24:32Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"3f21feb3-e014-440f-a16a-fba6870fdcbf","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-aadfb2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-aadfb2/models/facebook/opt-125m","name":"rate-test-model-aadfb2","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-1ba5b8","namespace":"ai-tenant-e2e-shared-a-aadfb2","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-aadfb2/rate-test-model-aadfb2"}}
{"level":"debug","ts":"2026-07-26T16:24:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"3f21feb3-e014-440f-a16a-fba6870fdcbf","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-26T16:24:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3f21feb3-e014-440f-a16a-fba6870fdcbf","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-26T16:24:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3f21feb3-e014-440f-a16a-fba6870fdcbf","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-26T16:24:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3f21feb3-e014-440f-a16a-fba6870fdcbf","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-aadfb2/rate-test-model-aadfb2\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-aadfb2/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-26T16:24:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3f21feb3-e014-440f-a16a-fba6870fdcbf","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-26T16:24:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3f21feb3-e014-440f-a16a-fba6870fdcbf","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-26T16:24:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3f21feb3-e014-440f-a16a-fba6870fdcbf","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-26T16:24:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3f21feb3-e014-440f-a16a-fba6870fdcbf","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-1ba5b8"}
{"level":"debug","ts":"2026-07-26T16:24:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3f21feb3-e014-440f-a16a-fba6870fdcbf","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"e16db9ca-e07d-41f8-b839-aadecb4bfca5","keyName":"e2e-rate-a-1ba5b8","selected_subscription":"e2e-rate-iso-a-1ba5b8","selected_subscription_key":"ai-tenant-e2e-shared-a-aadfb2/e2e-rate-iso-a-1ba5b8@ai-tenant-e2e-shared-a-aadfb2/rate-test-model-aadfb2","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-aadfb2/models/facebook/opt-125m","name":"rate-test-model-aadfb2","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-1ba5b8","namespace":"ai-tenant-e2e-shared-a-aadfb2","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-aadfb2/rate-test-model-aadfb2"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-26T16:24:32Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3f21feb3-e014-440f-a16a-fba6870fdcbf","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-26T16:24:32Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3f21feb3-e014-440f-a16a-fba6870fdcbf","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-26T16:24:33Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"672ae89e-02bd-4fa8-936c-67432d462a77","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:38546","PortSpecifier":{"PortValue":38546}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.68:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"672ae89e-02bd-4fa8-936c-67432d462a77","method":"POST","path":"/ai-tenant-e2e-shared-a-aadfb2/rate-test-model-aadfb2/v1/completions","host":"e2e-shared-a-aadfb2.apps.4c5817f4-713b-4eab-97fd-3d8252b1e299.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-26T16:24:33Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"672ae89e-02bd-4fa8-936c-67432d462a77","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:38546","PortSpecifier":{"PortValue":38546}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.68:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785083073,"nanos":814085083},"http":{"id":"672ae89e-02bd-4fa8-936c-67432d462a77","method":"POST","headers":{":authority":"e2e-shared-a-aadfb2.apps.4c5817f4-713b-4eab-97fd-3d8252b1e299.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-aadfb2/rate-test-model-aadfb2/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-26T16:24:33Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"672ae89e-02bd-4fa8-936c-67432d462a77","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-ptrFhfyYQMhz2aOc_evDnsXVIxR754z0nWgRK9pW0KFUu1LfmHAnJzf8hRiS"}
{"level":"debug","ts":"2026-07-26T16:24:33Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"672ae89e-02bd-4fa8-936c-67432d462a77","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-aadfb2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-ptrFhfyYQMhz2aOc_evDnsXVIxR754z0nWgRK9pW0KFUu1LfmHAnJzf8hRiS\"}"}
{"level":"debug","ts":"2026-07-26T16:24:33Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"672ae89e-02bd-4fa8-936c-67432d462a77","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-aadfb2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"e16db9ca-e07d-41f8-b839-aadecb4bfca5","keyName":"e2e-rate-a-1ba5b8","subscription":"e2e-rate-iso-a-1ba5b8","tenant":"e2e-shared-a-aadfb2","userId":"e16db9ca-e07d-41f8-b839-aadecb4bfca5","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-26T16:24:33Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"672ae89e-02bd-4fa8-936c-67432d462a77","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-aadfb2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-aadfb2/rate-test-model-aadfb2\",\"requestedSubscription\":\"e2e-rate-iso-a-1ba5b8\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-26T16:24:33Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"672ae89e-02bd-4fa8-936c-67432d462a77","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-aadfb2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-aadfb2/models/facebook/opt-125m","name":"rate-test-model-aadfb2","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-1ba5b8","namespace":"ai-tenant-e2e-shared-a-aadfb2","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-aadfb2/rate-test-model-aadfb2"}}
{"level":"debug","ts":"2026-07-26T16:24:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"672ae89e-02bd-4fa8-936c-67432d462a77","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-26T16:24:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"672ae89e-02bd-4fa8-936c-67432d462a77","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-26T16:24:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"672ae89e-02bd-4fa8-936c-67432d462a77","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-26T16:24:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"672ae89e-02bd-4fa8-936c-67432d462a77","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-26T16:24:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"672ae89e-02bd-4fa8-936c-67432d462a77","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-aadfb2/rate-test-model-aadfb2\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-aadfb2/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-26T16:24:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"672ae89e-02bd-4fa8-936c-67432d462a77","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-26T16:24:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"672ae89e-02bd-4fa8-936c-67432d462a77","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-1ba5b8"}
{"level":"debug","ts":"2026-07-26T16:24:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"672ae89e-02bd-4fa8-936c-67432d462a77","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-26T16:24:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"672ae89e-02bd-4fa8-936c-67432d462a77","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"e16db9ca-e07d-41f8-b839-aadecb4bfca5","keyName":"e2e-rate-a-1ba5b8","selected_subscription":"e2e-rate-iso-a-1ba5b8","selected_subscription_key":"ai-tenant-e2e-shared-a-aadfb2/e2e-rate-iso-a-1ba5b8@ai-tenant-e2e-shared-a-aadfb2/rate-test-model-aadfb2","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-aadfb2/models/facebook/opt-125m","name":"rate-test-model-aadfb2","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-1ba5b8","namespace":"ai-tenant-e2e-shared-a-aadfb2","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-aadfb2/rate-test-model-aadfb2"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-26T16:24:33Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"672ae89e-02bd-4fa8-936c-67432d462a77","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-26T16:24:33Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"672ae89e-02bd-4fa8-936c-67432d462a77","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-26T16:24:34Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"61de0fde-9433-491b-9760-585da5404064","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:38558","PortSpecifier":{"PortValue":38558}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.68:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"61de0fde-9433-491b-9760-585da5404064","method":"POST","path":"/ai-tenant-e2e-shared-a-aadfb2/rate-test-model-aadfb2/v1/completions","host":"e2e-shared-a-aadfb2.apps.4c5817f4-713b-4eab-97fd-3d8252b1e299.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-26T16:24:34Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"61de0fde-9433-491b-9760-585da5404064","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:38558","PortSpecifier":{"PortValue":38558}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.68:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785083074,"nanos":847357019},"http":{"id":"61de0fde-9433-491b-9760-585da5404064","method":"POST","headers":{":authority":"e2e-shared-a-aadfb2.apps.4c5817f4-713b-4eab-97fd-3d8252b1e299.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-aadfb2/rate-test-model-aadfb2/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-26T16:24:34Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"61de0fde-9433-491b-9760-585da5404064","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-ptrFhfyYQMhz2aOc_evDnsXVIxR754z0nWgRK9pW0KFUu1LfmHAnJzf8hRiS"}
{"level":"debug","ts":"2026-07-26T16:24:34Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"61de0fde-9433-491b-9760-585da5404064","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-aadfb2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-ptrFhfyYQMhz2aOc_evDnsXVIxR754z0nWgRK9pW0KFUu1LfmHAnJzf8hRiS\"}"}
{"level":"debug","ts":"2026-07-26T16:24:34Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"61de0fde-9433-491b-9760-585da5404064","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-aadfb2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"e16db9ca-e07d-41f8-b839-aadecb4bfca5","keyName":"e2e-rate-a-1ba5b8","subscription":"e2e-rate-iso-a-1ba5b8","tenant":"e2e-shared-a-aadfb2","userId":"e16db9ca-e07d-41f8-b839-aadecb4bfca5","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-26T16:24:34Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"61de0fde-9433-491b-9760-585da5404064","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-aadfb2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-aadfb2/rate-test-model-aadfb2\",\"requestedSubscription\":\"e2e-rate-iso-a-1ba5b8\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-26T16:24:34Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"61de0fde-9433-491b-9760-585da5404064","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-aadfb2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-aadfb2/models/facebook/opt-125m","name":"rate-test-model-aadfb2","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-1ba5b8","namespace":"ai-tenant-e2e-shared-a-aadfb2","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-aadfb2/rate-test-model-aadfb2"}}
{"level":"debug","ts":"2026-07-26T16:24:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"61de0fde-9433-491b-9760-585da5404064","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-26T16:24:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"61de0fde-9433-491b-9760-585da5404064","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-26T16:24:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"61de0fde-9433-491b-9760-585da5404064","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-26T16:24:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"61de0fde-9433-491b-9760-585da5404064","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-aadfb2/rate-test-model-aadfb2\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-aadfb2/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-26T16:24:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"61de0fde-9433-491b-9760-585da5404064","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-26T16:24:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"61de0fde-9433-491b-9760-585da5404064","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-26T16:24:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"61de0fde-9433-491b-9760-585da5404064","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-26T16:24:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"61de0fde-9433-491b-9760-585da5404064","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-1ba5b8"}
{"level":"debug","ts":"2026-07-26T16:24:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"61de0fde-9433-491b-9760-585da5404064","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"e16db9ca-e07d-41f8-b839-aadecb4bfca5","keyName":"e2e-rate-a-1ba5b8","selected_subscription":"e2e-rate-iso-a-1ba5b8","selected_subscription_key":"ai-tenant-e2e-shared-a-aadfb2/e2e-rate-iso-a-1ba5b8@ai-tenant-e2e-shared-a-aadfb2/rate-test-model-aadfb2","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-aadfb2/models/facebook/opt-125m","name":"rate-test-model-aadfb2","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-1ba5b8","namespace":"ai-tenant-e2e-shared-a-aadfb2","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-aadfb2/rate-test-model-aadfb2"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-26T16:24:34Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"61de0fde-9433-491b-9760-585da5404064","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-26T16:24:34Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"61de0fde-9433-491b-9760-585da5404064","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-26T16:24:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"30f65186-4806-47e6-9d03-d2be4e6208d0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:38574","PortSpecifier":{"PortValue":38574}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.68:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"30f65186-4806-47e6-9d03-d2be4e6208d0","method":"POST","path":"/ai-tenant-e2e-shared-a-aadfb2/rate-test-model-aadfb2/v1/completions","host":"e2e-shared-a-aadfb2.apps.4c5817f4-713b-4eab-97fd-3d8252b1e299.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-26T16:24:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"30f65186-4806-47e6-9d03-d2be4e6208d0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:38574","PortSpecifier":{"PortValue":38574}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.68:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785083075,"nanos":881247517},"http":{"id":"30f65186-4806-47e6-9d03-d2be4e6208d0","method":"POST","headers":{":authority":"e2e-shared-a-aadfb2.apps.4c5817f4-713b-4eab-97fd-3d8252b1e299.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-aadfb2/rate-test-model-aadfb2/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-26T16:24:35Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"30f65186-4806-47e6-9d03-d2be4e6208d0","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-ptrFhfyYQMhz2aOc_evDnsXVIxR754z0nWgRK9pW0KFUu1LfmHAnJzf8hRiS"}
{"level":"debug","ts":"2026-07-26T16:24:35Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"30f65186-4806-47e6-9d03-d2be4e6208d0","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-aadfb2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-ptrFhfyYQMhz2aOc_evDnsXVIxR754z0nWgRK9pW0KFUu1LfmHAnJzf8hRiS\"}"}
{"level":"debug","ts":"2026-07-26T16:24:35Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"30f65186-4806-47e6-9d03-d2be4e6208d0","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-aadfb2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"e16db9ca-e07d-41f8-b839-aadecb4bfca5","keyName":"e2e-rate-a-1ba5b8","subscription":"e2e-rate-iso-a-1ba5b8","tenant":"e2e-shared-a-aadfb2","userId":"e16db9ca-e07d-41f8-b839-aadecb4bfca5","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-26T16:24:35Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"30f65186-4806-47e6-9d03-d2be4e6208d0","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-aadfb2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-aadfb2/rate-test-model-aadfb2\",\"requestedSubscription\":\"e2e-rate-iso-a-1ba5b8\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-26T16:24:35Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"30f65186-4806-47e6-9d03-d2be4e6208d0","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-aadfb2.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-aadfb2/models/facebook/opt-125m","name":"rate-test-model-aadfb2","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-1ba5b8","namespace":"ai-tenant-e2e-shared-a-aadfb2","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-aadfb2/rate-test-model-aadfb2"}}
{"level":"debug","ts":"2026-07-26T16:24:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"30f65186-4806-47e6-9d03-d2be4e6208d0","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-26T16:24:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"30f65186-4806-47e6-9d03-d2be4e6208d0","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-26T16:24:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"30f65186-4806-47e6-9d03-d2be4e6208d0","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-26T16:24:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"30f65186-4806-47e6-9d03-d2be4e6208d0","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-aadfb2/rate-test-model-aadfb2\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-aadfb2/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-26T16:24:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"30f65186-4806-47e6-9d03-d2be4e6208d0","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-26T16:24:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"30f65186-4806-47e6-9d03-d2be4e6208d0","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-26T16:24:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"30f65186-4806-47e6-9d03-d2be4e6208d0","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-26T16:24:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"30f65186-4806-47e6-9d03-d2be4e6208d0","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-1ba5b8"}
{"level":"debug","ts":"2026-07-26T16:24:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"30f65186-4806-47e6-9d03-d2be4e6208d0","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"e16db9ca-e07d-41f8-b839-aadecb4bfca5","keyName":"e2e-rate-a-1ba5b8","selected_subscription":"e2e-rate-iso-a-1ba5b8","selected_subscription_key":"ai-tenant-e2e-shared-a-aadfb2/e2e-rate-iso-a-1ba5b8@ai-tenant-e2e-shared-a-aadfb2/rate-test-model-aadfb2","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-aadfb2/models/facebook/opt-125m","name":"rate-test-model-aadfb2","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-1ba5b8","namespace":"ai-tenant-e2e-shared-a-aadfb2","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-aadfb2/rate-test-model-aadfb2"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-26T16:24:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"30f65186-4806-47e6-9d03-d2be4e6208d0","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-26T16:24:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"30f65186-4806-47e6-9d03-d2be4e6208d0","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-26T16:24:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"4e29ce13-7d62-4766-9751-066528f6dd5f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:50146","PortSpecifier":{"PortValue":50146}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.69:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"4e29ce13-7d62-4766-9751-066528f6dd5f","method":"POST","path":"/ai-tenant-e2e-shared-b-e0208c/rate-test-model-e0208c/v1/completions","host":"e2e-shared-b-e0208c.apps.4c5817f4-713b-4eab-97fd-3d8252b1e299.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-26T16:24:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"4e29ce13-7d62-4766-9751-066528f6dd5f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:50146","PortSpecifier":{"PortValue":50146}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.69:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785083075,"nanos":914036685},"http":{"id":"4e29ce13-7d62-4766-9751-066528f6dd5f","method":"POST","headers":{":authority":"e2e-shared-b-e0208c.apps.4c5817f4-713b-4eab-97fd-3d8252b1e299.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-b-e0208c/rate-test-model-e0208c/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-26T16:24:35Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"4e29ce13-7d62-4766-9751-066528f6dd5f","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-147fy75Bw7CdiaubT_tTIwyKJQJIBpsKy445WAT5sPAubKHHIZQ1a3jPZSO4M"}
{"level":"debug","ts":"2026-07-26T16:24:35Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"4e29ce13-7d62-4766-9751-066528f6dd5f","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-b-e0208c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-147fy75Bw7CdiaubT_tTIwyKJQJIBpsKy445WAT5sPAubKHHIZQ1a3jPZSO4M\"}"}
{"level":"debug","ts":"2026-07-26T16:24:35Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"4e29ce13-7d62-4766-9751-066528f6dd5f","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-e0208c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"5b29b7b6-3312-4bf4-aee9-430be60e3aae","keyName":"e2e-rate-b-1ba5b8","subscription":"e2e-rate-iso-b-1ba5b8","tenant":"e2e-shared-b-e0208c","userId":"5b29b7b6-3312-4bf4-aee9-430be60e3aae","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-26T16:24:35Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"4e29ce13-7d62-4766-9751-066528f6dd5f","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-b-e0208c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-b-e0208c/rate-test-model-e0208c\",\"requestedSubscription\":\"e2e-rate-iso-b-1ba5b8\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-26T16:24:35Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"4e29ce13-7d62-4766-9751-066528f6dd5f","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-e0208c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-b-e0208c/models/facebook/opt-125m","name":"rate-test-model-e0208c","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-1ba5b8","namespace":"ai-tenant-e2e-shared-b-e0208c","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-b-e0208c/rate-test-model-e0208c"}}
{"level":"debug","ts":"2026-07-26T16:24:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"4e29ce13-7d62-4766-9751-066528f6dd5f","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-26T16:24:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4e29ce13-7d62-4766-9751-066528f6dd5f","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-26T16:24:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4e29ce13-7d62-4766-9751-066528f6dd5f","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-26T16:24:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4e29ce13-7d62-4766-9751-066528f6dd5f","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-26T16:24:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4e29ce13-7d62-4766-9751-066528f6dd5f","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-e0208c/rate-test-model-e0208c\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-e0208c/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-26T16:24:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4e29ce13-7d62-4766-9751-066528f6dd5f","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-b-1ba5b8"}
{"level":"debug","ts":"2026-07-26T16:24:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4e29ce13-7d62-4766-9751-066528f6dd5f","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-26T16:24:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4e29ce13-7d62-4766-9751-066528f6dd5f","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-26T16:24:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4e29ce13-7d62-4766-9751-066528f6dd5f","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"5b29b7b6-3312-4bf4-aee9-430be60e3aae","keyName":"e2e-rate-b-1ba5b8","selected_subscription":"e2e-rate-iso-b-1ba5b8","selected_subscription_key":"ai-tenant-e2e-shared-b-e0208c/e2e-rate-iso-b-1ba5b8@ai-tenant-e2e-shared-b-e0208c/rate-test-model-e0208c","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-b-e0208c/models/facebook/opt-125m","name":"rate-test-model-e0208c","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-1ba5b8","namespace":"ai-tenant-e2e-shared-b-e0208c","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-b-e0208c/rate-test-model-e0208c"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-26T16:24:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4e29ce13-7d62-4766-9751-066528f6dd5f","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-26T16:24:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4e29ce13-7d62-4766-9751-066528f6dd5f","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-26T16:24:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/321ff6a6f1aa418e3c3e1b877a45688ef4be7d22113c8b1421d5e474d4758612"}
{"level":"info","ts":"2026-07-26T16:24:41Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/cfd85e17da80e4abbaf3295b6fe8821c38a821eb195329200dfce476f0e6b41c"}
{"level":"info","ts":"2026-07-26T16:24:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/73131ccccc680c05ac8e16590e8eaf35463569ac55eace0a978db680b8aeae35"}
{"level":"info","ts":"2026-07-26T16:24:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/fb7fff3f1327442e80d41ab09d575d4094e9177dc662a8dc9d93dc6c767f2715"}
{"level":"info","ts":"2026-07-26T16:24:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/f318557c7c1df5c4b19fed1a58e04224b7394f16a7717841f070b6f992d55a19"}
{"level":"info","ts":"2026-07-26T16:24:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/3ed5ad5aad603648d8514d576e02e158830c4533095d668d692453a7995b8e7d"}
{"level":"info","ts":"2026-07-26T16:24:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/85cf0d870f1213f40f990a854b8de57016d624aca2c685fea2def9bfc26820a9"}
{"level":"info","ts":"2026-07-26T16:24:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/93bcb7e6deb1792c99da6f547ea6a82682f26381087d59cf27e14f6c966952f8"}
{"level":"info","ts":"2026-07-26T16:24:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/5d6fc6e5892af2f0bc1d30f6bed20a7cacc12e9683af8191bfb24bbed850da90"}
{"level":"info","ts":"2026-07-26T16:24:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/e6c3aea275bb92559cf811138fad57d225a15b8b953ebf7ee4c5bcf9843f8504"}
{"level":"info","ts":"2026-07-26T16:24:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/1cfc3001247d305720e6f8483a5053a058c874cb234363fc991f3a9537480e47"}
{"level":"info","ts":"2026-07-26T16:24:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/3486e866e09dd9bd58d39cd578874c38e5c8dedafddc74cf4fe5393005345d50"}
{"level":"info","ts":"2026-07-26T16:24:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/de2a16fd8529600e97ff43ded0f608bdb63ee291ae0d473bb3f35b2a23d1126c"}
{"level":"info","ts":"2026-07-26T16:24:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/7b2c13f7008b9ce62806d8f43c818ad535a264a073bf527e07924fecdece705c"}
{"level":"info","ts":"2026-07-26T16:24:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/bc28649a0a01cd5b9fdf12dd996e9cbd953ca2e7a7771607aeacac5a221a39ce"}
{"level":"info","ts":"2026-07-26T16:24:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/3473155852b265ffc53fbc92f53c265d52eb04f1cc2fbb88c97c1e2aefbabe99"}
{"level":"info","ts":"2026-07-26T16:24:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/0c9204d36ea016b772ad7ebbc0a44e07e36814fff9275800b16bbc553bbd9ebe"}
{"level":"info","ts":"2026-07-26T16:24:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/77463692c8147ca7e2e174abe607a6f13049ad5caf990937b50e55fd529ee751"}
{"level":"info","ts":"2026-07-26T16:24:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/d058fa14af92726ea4f95e4249567827fdf37b451aa14e48ab2c2e757ecb826a"}
{"level":"info","ts":"2026-07-26T16:24:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/6a6d937d6d10ca4900845c6c6dd08539bf218e3ae9d02a37dd82c0f5785bf313"}
{"level":"info","ts":"2026-07-26T16:24:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/629b0089b5c13918b49aa15f37a46c15886bf9175a5320da01b65defa3775e10"}
{"level":"info","ts":"2026-07-26T16:24:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/eae698b99550fcf78ca46602ffea70b4e1b23cd4998c24fc1d42e8a94fb79163"}
{"level":"info","ts":"2026-07-26T16:24:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/da97f83efb7400aeb0140dddf5d5d329b3c9fdcf3cfeb2748dd83a420646c9e0"}
{"level":"info","ts":"2026-07-26T16:24:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/956c711388fcac704c2d8e7c7147528a8bca23b8b06b63950e2ea9fb2e2243d6"}
{"level":"info","ts":"2026-07-26T16:25:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"54fec0d6-9333-4499-8771-4c1a42b83c26","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:36808","PortSpecifier":{"PortValue":36808}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"54fec0d6-9333-4499-8771-4c1a42b83c26","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.4c5817f4-713b-4eab-97fd-3d8252b1e299.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-26T16:25:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"54fec0d6-9333-4499-8771-4c1a42b83c26","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:36808","PortSpecifier":{"PortValue":36808}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785083146,"nanos":353590006},"http":{"id":"54fec0d6-9333-4499-8771-4c1a42b83c26","method":"POST","headers":{":authority":"maas.apps.4c5817f4-713b-4eab-97fd-3d8252b1e299.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-26T16:25:46Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"54fec0d6-9333-4499-8771-4c1a42b83c26","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-26T16:25:46Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"54fec0d6-9333-4499-8771-4c1a42b83c26","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"152070b3-08f0-451d-a549-25cf7f44a8bd","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=365ca425-c8f4-4347-a44f-32434e7dc959"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/3d8252b1e299"]}}
{"level":"debug","ts":"2026-07-26T16:25:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"54fec0d6-9333-4499-8771-4c1a42b83c26","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/3d8252b1e299"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=365ca425-c8f4-4347-a44f-32434e7dc959"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"152070b3-08f0-451d-a549-25cf7f44a8bd","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.48:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.4c5817f4-713b-4eab-97fd-3d8252b1e299.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-26T16:25:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"54fec0d6-9333-4499-8771-4c1a42b83c26","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-26T16:25:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"54fec0d6-9333-4499-8771-4c1a42b83c26","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-26T16:25:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"54fec0d6-9333-4499-8771-4c1a42b83c26","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]},\"publishers/llm/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/llm/models/facebook/opt-125m-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-26T16:25:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"54fec0d6-9333-4499-8771-4c1a42b83c26","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-26T16:25:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"54fec0d6-9333-4499-8771-4c1a42b83c26","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-26T16:25:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"54fec0d6-9333-4499-8771-4c1a42b83c26","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-26T16:25:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"54fec0d6-9333-4499-8771-4c1a42b83c26","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-26T16:25:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"54fec0d6-9333-4499-8771-4c1a42b83c26","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-26T16:25:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"90ee01cc-4865-4adc-8803-b9d3b71524d9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:36814","PortSpecifier":{"PortValue":36814}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"90ee01cc-4865-4adc-8803-b9d3b71524d9","method":"POST","path":"/llm/facebook-opt-125m-simulated/v1/chat/completions","host":"maas.apps.4c5817f4-713b-4eab-97fd-3d8252b1e299.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-26T16:25:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"90ee01cc-4865-4adc-8803-b9d3b71524d9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:36814","PortSpecifier":{"PortValue":36814}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.48:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785083146,"nanos":404538838},"http":{"id":"90ee01cc-4865-4adc-8803-b9d3b71524d9","method":"POST","headers":{":authority":"maas.apps.4c5817f4-713b-4eab-97fd-3d8252b1e299.prod.konfluxeaas.com",":method":"POST",":path":"/llm/facebook-opt-125m-simulated/v1/chat/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-26T16:25:46Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"90ee01cc-4865-4adc-8803-b9d3b71524d9","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1TIaZxcQ79TCbSqgh_a7N9Ps5ySF9yONxI0wzncyR7hJz01N8mLpA806ykQa1"}
{"level":"debug","ts":"2026-07-26T16:25:46Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"90ee01cc-4865-4adc-8803-b9d3b71524d9","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1TIaZxcQ79TCbSqgh_a7N9Ps5ySF9yONxI0wzncyR7hJz01N8mLpA806ykQa1\"}"}
{"level":"debug","ts":"2026-07-26T16:25:46Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"90ee01cc-4865-4adc-8803-b9d3b71524d9","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"b1835320-85bf-40fb-b693-c48b86284493","keyName":"e2e-ipp-default","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"b1835320-85bf-40fb-b693-c48b86284493","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-26T16:25:46Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"90ee01cc-4865-4adc-8803-b9d3b71524d9","config":"subscription-info","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"llm/facebook-opt-125m-simulated\",\"requestedSubscription\":\"simulator-subscription\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-26T16:25:46Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"90ee01cc-4865-4adc-8803-b9d3b71524d9","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","model_name":"publishers/llm/models/facebook/opt-125m","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true,"resolvedModel":"llm/facebook-opt-125m-simulated"}}
{"level":"debug","ts":"2026-07-26T16:25:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"90ee01cc-4865-4adc-8803-b9d3b71524d9","input":{"auth":{"identity":"Bearer **** subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","model_name":"publishers/llm/models/facebook/opt-125m","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true,"resolvedModel":"llm/facebook-opt-125m-simulated"}}},"context":{"context_extensions":{"host":"311b1be286674fd5684c9ac59b318287dade9769cfe4aeebd8c88e2dc6b72418"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.48:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.4c5817f4-713b-4eab-97fd-3d8252b1e299.prod.konfluxeaas.com",":method":"POST",":path":"/llm/facebook-opt-125m-simulated/v1/chat/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-26T16:25:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"90ee01cc-4865-4adc-8803-b9d3b71524d9","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-26T16:25:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"90ee01cc-4865-4adc-8803-b9d3b71524d9","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-26T16:25:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"90ee01cc-4865-4adc-8803-b9d3b71524d9","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]},\"publishers/llm/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/llm/models/facebook/opt-125m-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-26T16:25:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"90ee01cc-4865-4adc-8803-b9d3b71524d9","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-26T16:25:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"90ee01cc-4865-4adc-8803-b9d3b71524d9","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-26T16:25:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"90ee01cc-4865-4adc-8803-b9d3b71524d9","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-26T16:25:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"90ee01cc-4865-4adc-8803-b9d3b71524d9","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-26T16:25:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"90ee01cc-4865-4adc-8803-b9d3b71524d9","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"b1835320-85bf-40fb-b693-c48b86284493","keyName":"e2e-ipp-default","selected_subscription":"simulator-subscription","selected_subscription_key":"models-as-a-service/simulator-subscription@llm/facebook-opt-125m-simulated","subscription_error":"","subscription_error_message":"","subscription_info":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","model_name":"publishers/llm/models/facebook/opt-125m","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true,"resolvedModel":"llm/facebook-opt-125m-simulated"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-26T16:25:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"90ee01cc-4865-4adc-8803-b9d3b71524d9","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-26T16:25:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"90ee01cc-4865-4adc-8803-b9d3b71524d9","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-26T16:26:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"019ca7b2a581d913ed552786d6edf1e7747b079f75d1710b482a837df47e1978","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-26T16:26:22Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-26T16:26:22Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-26T16:26:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"019ca7b2a581d913ed552786d6edf1e7747b079f75d1710b482a837df47e1978","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:26:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"019ca7b2a581d913ed552786d6edf1e7747b079f75d1710b482a837df47e1978","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:26:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"019ca7b2a581d913ed552786d6edf1e7747b079f75d1710b482a837df47e1978","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-26T16:26:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/019ca7b2a581d913ed552786d6edf1e7747b079f75d1710b482a837df47e1978"}
{"level":"debug","ts":"2026-07-26T16:26:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"019ca7b2a581d913ed552786d6edf1e7747b079f75d1710b482a837df47e1978","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-26T16:26:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/019ca7b2a581d913ed552786d6edf1e7747b079f75d1710b482a837df47e1978"}
{"level":"debug","ts":"2026-07-26T16:26:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"019ca7b2a581d913ed552786d6edf1e7747b079f75d1710b482a837df47e1978","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-26T16:26:22Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-26T16:26:22Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["019ca7b2a581d913ed552786d6edf1e7747b079f75d1710b482a837df47e1978"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-26T16:26:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"019ca7b2a581d913ed552786d6edf1e7747b079f75d1710b482a837df47e1978","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:26:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"019ca7b2a581d913ed552786d6edf1e7747b079f75d1710b482a837df47e1978","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-26T16:26:22Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-26T16:26:22Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-26T16:26:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"019ca7b2a581d913ed552786d6edf1e7747b079f75d1710b482a837df47e1978","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:26:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"019ca7b2a581d913ed552786d6edf1e7747b079f75d1710b482a837df47e1978","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:26:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"019ca7b2a581d913ed552786d6edf1e7747b079f75d1710b482a837df47e1978","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-26T16:26:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/019ca7b2a581d913ed552786d6edf1e7747b079f75d1710b482a837df47e1978"}
{"level":"debug","ts":"2026-07-26T16:26:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"019ca7b2a581d913ed552786d6edf1e7747b079f75d1710b482a837df47e1978","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-26T16:26:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/019ca7b2a581d913ed552786d6edf1e7747b079f75d1710b482a837df47e1978"}
{"level":"debug","ts":"2026-07-26T16:26:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"019ca7b2a581d913ed552786d6edf1e7747b079f75d1710b482a837df47e1978","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-26T16:26:22Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-26T16:26:22Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["019ca7b2a581d913ed552786d6edf1e7747b079f75d1710b482a837df47e1978"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-26T16:26:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"019ca7b2a581d913ed552786d6edf1e7747b079f75d1710b482a837df47e1978","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:26:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"019ca7b2a581d913ed552786d6edf1e7747b079f75d1710b482a837df47e1978","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-26T16:26:22Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-26T16:26:22Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-26T16:26:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"019ca7b2a581d913ed552786d6edf1e7747b079f75d1710b482a837df47e1978","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:26:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"fb64f573020ee198cb6e73c065184b9d65f485af909f526fffff531a3c410323","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-26T16:26:22Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-26T16:26:22Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-26T16:26:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/019ca7b2a581d913ed552786d6edf1e7747b079f75d1710b482a837df47e1978"}
{"level":"info","ts":"2026-07-26T16:26:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"fb64f573020ee198cb6e73c065184b9d65f485af909f526fffff531a3c410323","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:26:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"019ca7b2a581d913ed552786d6edf1e7747b079f75d1710b482a837df47e1978","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-26T16:26:22Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-26T16:26:22Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["019ca7b2a581d913ed552786d6edf1e7747b079f75d1710b482a837df47e1978"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-26T16:26:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/fb64f573020ee198cb6e73c065184b9d65f485af909f526fffff531a3c410323"}
{"level":"info","ts":"2026-07-26T16:26:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"019ca7b2a581d913ed552786d6edf1e7747b079f75d1710b482a837df47e1978","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:26:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"fb64f573020ee198cb6e73c065184b9d65f485af909f526fffff531a3c410323","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-26T16:26:22Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-26T16:26:22Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["fb64f573020ee198cb6e73c065184b9d65f485af909f526fffff531a3c410323"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-26T16:26:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"fb64f573020ee198cb6e73c065184b9d65f485af909f526fffff531a3c410323","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:26:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"019ca7b2a581d913ed552786d6edf1e7747b079f75d1710b482a837df47e1978","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-26T16:26:22Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-26T16:26:22Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-26T16:26:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/019ca7b2a581d913ed552786d6edf1e7747b079f75d1710b482a837df47e1978"}
{"level":"info","ts":"2026-07-26T16:26:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"019ca7b2a581d913ed552786d6edf1e7747b079f75d1710b482a837df47e1978","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:26:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"fb64f573020ee198cb6e73c065184b9d65f485af909f526fffff531a3c410323","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-26T16:26:22Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-26T16:26:22Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-26T16:26:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/fb64f573020ee198cb6e73c065184b9d65f485af909f526fffff531a3c410323"}
{"level":"info","ts":"2026-07-26T16:26:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"fb64f573020ee198cb6e73c065184b9d65f485af909f526fffff531a3c410323","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:26:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"019ca7b2a581d913ed552786d6edf1e7747b079f75d1710b482a837df47e1978","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:26:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"fb64f573020ee198cb6e73c065184b9d65f485af909f526fffff531a3c410323","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-26T16:26:22Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-26T16:26:22Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["fb64f573020ee198cb6e73c065184b9d65f485af909f526fffff531a3c410323"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-26T16:26:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/019ca7b2a581d913ed552786d6edf1e7747b079f75d1710b482a837df47e1978"}
{"level":"info","ts":"2026-07-26T16:26:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"fb64f573020ee198cb6e73c065184b9d65f485af909f526fffff531a3c410323","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:26:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"019ca7b2a581d913ed552786d6edf1e7747b079f75d1710b482a837df47e1978","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-26T16:26:22Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-26T16:26:22Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["019ca7b2a581d913ed552786d6edf1e7747b079f75d1710b482a837df47e1978"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-26T16:26:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"019ca7b2a581d913ed552786d6edf1e7747b079f75d1710b482a837df47e1978","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:26:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"fb64f573020ee198cb6e73c065184b9d65f485af909f526fffff531a3c410323","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-26T16:26:22Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-26T16:26:22Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-26T16:26:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/fb64f573020ee198cb6e73c065184b9d65f485af909f526fffff531a3c410323"}
{"level":"info","ts":"2026-07-26T16:26:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"fb64f573020ee198cb6e73c065184b9d65f485af909f526fffff531a3c410323","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:26:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"019ca7b2a581d913ed552786d6edf1e7747b079f75d1710b482a837df47e1978","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-26T16:26:22Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-26T16:26:22Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-26T16:26:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/019ca7b2a581d913ed552786d6edf1e7747b079f75d1710b482a837df47e1978"}
{"level":"info","ts":"2026-07-26T16:26:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"019ca7b2a581d913ed552786d6edf1e7747b079f75d1710b482a837df47e1978","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:26:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"fb64f573020ee198cb6e73c065184b9d65f485af909f526fffff531a3c410323","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:26:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"019ca7b2a581d913ed552786d6edf1e7747b079f75d1710b482a837df47e1978","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-26T16:26:22Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-26T16:26:22Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["019ca7b2a581d913ed552786d6edf1e7747b079f75d1710b482a837df47e1978"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-26T16:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"019ca7b2a581d913ed552786d6edf1e7747b079f75d1710b482a837df47e1978","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"fb64f573020ee198cb6e73c065184b9d65f485af909f526fffff531a3c410323","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"019ca7b2a581d913ed552786d6edf1e7747b079f75d1710b482a837df47e1978","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-26T16:26:23Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-26T16:26:23Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["019ca7b2a581d913ed552786d6edf1e7747b079f75d1710b482a837df47e1978"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-26T16:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/fb64f573020ee198cb6e73c065184b9d65f485af909f526fffff531a3c410323"}
{"level":"error","ts":"2026-07-26T16:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"019ca7b2a581d913ed552786d6edf1e7747b079f75d1710b482a837df47e1978","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"019ca7b2a581d913ed552786d6edf1e7747b079f75d1710b482a837df47e1978\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-26T16:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"019ca7b2a581d913ed552786d6edf1e7747b079f75d1710b482a837df47e1978","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-26T16:26:23Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-26T16:26:23Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-26T16:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/019ca7b2a581d913ed552786d6edf1e7747b079f75d1710b482a837df47e1978"}
{"level":"info","ts":"2026-07-26T16:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"019ca7b2a581d913ed552786d6edf1e7747b079f75d1710b482a837df47e1978","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"fb64f573020ee198cb6e73c065184b9d65f485af909f526fffff531a3c410323","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-26T16:26:23Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-26T16:26:23Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["fb64f573020ee198cb6e73c065184b9d65f485af909f526fffff531a3c410323"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-26T16:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"fb64f573020ee198cb6e73c065184b9d65f485af909f526fffff531a3c410323","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"019ca7b2a581d913ed552786d6edf1e7747b079f75d1710b482a837df47e1978","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1a3c775e41329f4b1023786304d2914911e0db316cf47a38bccf94a026f1ca1d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-26T16:26:23Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-26T16:26:23Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-26T16:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/019ca7b2a581d913ed552786d6edf1e7747b079f75d1710b482a837df47e1978"}
{"level":"info","ts":"2026-07-26T16:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1a3c775e41329f4b1023786304d2914911e0db316cf47a38bccf94a026f1ca1d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"fb64f573020ee198cb6e73c065184b9d65f485af909f526fffff531a3c410323","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1a3c775e41329f4b1023786304d2914911e0db316cf47a38bccf94a026f1ca1d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-26T16:26:23Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-26T16:26:23Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-26T16:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1a3c775e41329f4b1023786304d2914911e0db316cf47a38bccf94a026f1ca1d"}
{"level":"info","ts":"2026-07-26T16:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1a3c775e41329f4b1023786304d2914911e0db316cf47a38bccf94a026f1ca1d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"019ca7b2a581d913ed552786d6edf1e7747b079f75d1710b482a837df47e1978","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-26T16:26:23Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-26T16:26:23Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["019ca7b2a581d913ed552786d6edf1e7747b079f75d1710b482a837df47e1978"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-26T16:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"019ca7b2a581d913ed552786d6edf1e7747b079f75d1710b482a837df47e1978","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1a3c775e41329f4b1023786304d2914911e0db316cf47a38bccf94a026f1ca1d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-26T16:26:23Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-26T16:26:23Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["1a3c775e41329f4b1023786304d2914911e0db316cf47a38bccf94a026f1ca1d"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-26T16:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/fb64f573020ee198cb6e73c065184b9d65f485af909f526fffff531a3c410323"}
{"level":"info","ts":"2026-07-26T16:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1a3c775e41329f4b1023786304d2914911e0db316cf47a38bccf94a026f1ca1d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"019ca7b2a581d913ed552786d6edf1e7747b079f75d1710b482a837df47e1978","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1a3c775e41329f4b1023786304d2914911e0db316cf47a38bccf94a026f1ca1d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-26T16:26:23Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-26T16:26:23Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-26T16:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1a3c775e41329f4b1023786304d2914911e0db316cf47a38bccf94a026f1ca1d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1a3c775e41329f4b1023786304d2914911e0db316cf47a38bccf94a026f1ca1d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-26T16:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1a3c775e41329f4b1023786304d2914911e0db316cf47a38bccf94a026f1ca1d"}
{"level":"debug","ts":"2026-07-26T16:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1a3c775e41329f4b1023786304d2914911e0db316cf47a38bccf94a026f1ca1d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-26T16:26:23Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-26T16:26:23Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["1a3c775e41329f4b1023786304d2914911e0db316cf47a38bccf94a026f1ca1d"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-26T16:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1a3c775e41329f4b1023786304d2914911e0db316cf47a38bccf94a026f1ca1d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1a3c775e41329f4b1023786304d2914911e0db316cf47a38bccf94a026f1ca1d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-26T16:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/019ca7b2a581d913ed552786d6edf1e7747b079f75d1710b482a837df47e1978"}
{"level":"info","ts":"2026-07-26T16:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1a3c775e41329f4b1023786304d2914911e0db316cf47a38bccf94a026f1ca1d"}
{"level":"debug","ts":"2026-07-26T16:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"39b92ad049ea17b26706b1b9b0931340d744aa632017ab15a2663f6b5204a82c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-26T16:26:23Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-26T16:26:23Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-26T16:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"39b92ad049ea17b26706b1b9b0931340d744aa632017ab15a2663f6b5204a82c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"39b92ad049ea17b26706b1b9b0931340d744aa632017ab15a2663f6b5204a82c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-26T16:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/39b92ad049ea17b26706b1b9b0931340d744aa632017ab15a2663f6b5204a82c"}
{"level":"debug","ts":"2026-07-26T16:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"39b92ad049ea17b26706b1b9b0931340d744aa632017ab15a2663f6b5204a82c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"39b92ad049ea17b26706b1b9b0931340d744aa632017ab15a2663f6b5204a82c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-26T16:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/39b92ad049ea17b26706b1b9b0931340d744aa632017ab15a2663f6b5204a82c"}
{"level":"debug","ts":"2026-07-26T16:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"39b92ad049ea17b26706b1b9b0931340d744aa632017ab15a2663f6b5204a82c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-26T16:26:23Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-26T16:26:23Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["39b92ad049ea17b26706b1b9b0931340d744aa632017ab15a2663f6b5204a82c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-26T16:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"39b92ad049ea17b26706b1b9b0931340d744aa632017ab15a2663f6b5204a82c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6af4f43925a2ef7bfc460dd796c04de9b6978ccbda82e8189eca1e5606e282ff","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-26T16:26:23Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-26T16:26:23Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-26T16:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6af4f43925a2ef7bfc460dd796c04de9b6978ccbda82e8189eca1e5606e282ff","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"39b92ad049ea17b26706b1b9b0931340d744aa632017ab15a2663f6b5204a82c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-26T16:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6af4f43925a2ef7bfc460dd796c04de9b6978ccbda82e8189eca1e5606e282ff"}
{"level":"debug","ts":"2026-07-26T16:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6af4f43925a2ef7bfc460dd796c04de9b6978ccbda82e8189eca1e5606e282ff","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-26T16:26:23Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-26T16:26:23Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["6af4f43925a2ef7bfc460dd796c04de9b6978ccbda82e8189eca1e5606e282ff"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-26T16:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/39b92ad049ea17b26706b1b9b0931340d744aa632017ab15a2663f6b5204a82c"}
{"level":"info","ts":"2026-07-26T16:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6af4f43925a2ef7bfc460dd796c04de9b6978ccbda82e8189eca1e5606e282ff","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6af4f43925a2ef7bfc460dd796c04de9b6978ccbda82e8189eca1e5606e282ff","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6af4f43925a2ef7bfc460dd796c04de9b6978ccbda82e8189eca1e5606e282ff","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-26T16:26:23Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-26T16:26:23Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-26T16:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6af4f43925a2ef7bfc460dd796c04de9b6978ccbda82e8189eca1e5606e282ff"}
{"level":"info","ts":"2026-07-26T16:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6af4f43925a2ef7bfc460dd796c04de9b6978ccbda82e8189eca1e5606e282ff","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6af4f43925a2ef7bfc460dd796c04de9b6978ccbda82e8189eca1e5606e282ff","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-26T16:26:23Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-26T16:26:23Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"error","ts":"2026-07-26T16:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"6af4f43925a2ef7bfc460dd796c04de9b6978ccbda82e8189eca1e5606e282ff","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"6af4f43925a2ef7bfc460dd796c04de9b6978ccbda82e8189eca1e5606e282ff\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-26T16:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6af4f43925a2ef7bfc460dd796c04de9b6978ccbda82e8189eca1e5606e282ff","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a0a49b0c44daf5eac0a28eb8fc4a58218f346e70d3aaad3f6e4f31227cbe3897","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-26T16:26:23Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-26T16:26:23Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-26T16:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6af4f43925a2ef7bfc460dd796c04de9b6978ccbda82e8189eca1e5606e282ff"}
{"level":"info","ts":"2026-07-26T16:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a0a49b0c44daf5eac0a28eb8fc4a58218f346e70d3aaad3f6e4f31227cbe3897","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a0a49b0c44daf5eac0a28eb8fc4a58218f346e70d3aaad3f6e4f31227cbe3897","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-26T16:26:23Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-26T16:26:23Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-26T16:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a0a49b0c44daf5eac0a28eb8fc4a58218f346e70d3aaad3f6e4f31227cbe3897","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6af4f43925a2ef7bfc460dd796c04de9b6978ccbda82e8189eca1e5606e282ff","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-26T16:26:23Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-26T16:26:23Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["6af4f43925a2ef7bfc460dd796c04de9b6978ccbda82e8189eca1e5606e282ff"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-26T16:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a0a49b0c44daf5eac0a28eb8fc4a58218f346e70d3aaad3f6e4f31227cbe3897"}
{"level":"info","ts":"2026-07-26T16:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6af4f43925a2ef7bfc460dd796c04de9b6978ccbda82e8189eca1e5606e282ff","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a0a49b0c44daf5eac0a28eb8fc4a58218f346e70d3aaad3f6e4f31227cbe3897","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-26T16:26:23Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-26T16:26:23Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a0a49b0c44daf5eac0a28eb8fc4a58218f346e70d3aaad3f6e4f31227cbe3897"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-26T16:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a0a49b0c44daf5eac0a28eb8fc4a58218f346e70d3aaad3f6e4f31227cbe3897","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6af4f43925a2ef7bfc460dd796c04de9b6978ccbda82e8189eca1e5606e282ff","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-26T16:26:23Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-26T16:26:23Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-26T16:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6af4f43925a2ef7bfc460dd796c04de9b6978ccbda82e8189eca1e5606e282ff"}
{"level":"info","ts":"2026-07-26T16:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6af4f43925a2ef7bfc460dd796c04de9b6978ccbda82e8189eca1e5606e282ff","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a0a49b0c44daf5eac0a28eb8fc4a58218f346e70d3aaad3f6e4f31227cbe3897","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-26T16:26:23Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-26T16:26:23Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-26T16:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a0a49b0c44daf5eac0a28eb8fc4a58218f346e70d3aaad3f6e4f31227cbe3897","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6af4f43925a2ef7bfc460dd796c04de9b6978ccbda82e8189eca1e5606e282ff","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-26T16:26:23Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-26T16:26:23Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["6af4f43925a2ef7bfc460dd796c04de9b6978ccbda82e8189eca1e5606e282ff"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-26T16:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a0a49b0c44daf5eac0a28eb8fc4a58218f346e70d3aaad3f6e4f31227cbe3897"}
{"level":"info","ts":"2026-07-26T16:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6af4f43925a2ef7bfc460dd796c04de9b6978ccbda82e8189eca1e5606e282ff","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5466d75206556ff1585574b133e851a9ed1bed9af06a31c2ddf1d4b028a960d8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-26T16:26:23Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-26T16:26:23Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-26T16:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5466d75206556ff1585574b133e851a9ed1bed9af06a31c2ddf1d4b028a960d8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a0a49b0c44daf5eac0a28eb8fc4a58218f346e70d3aaad3f6e4f31227cbe3897","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-26T16:26:23Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-26T16:26:23Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a0a49b0c44daf5eac0a28eb8fc4a58218f346e70d3aaad3f6e4f31227cbe3897"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-26T16:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6af4f43925a2ef7bfc460dd796c04de9b6978ccbda82e8189eca1e5606e282ff"}
{"level":"info","ts":"2026-07-26T16:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a0a49b0c44daf5eac0a28eb8fc4a58218f346e70d3aaad3f6e4f31227cbe3897","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6af4f43925a2ef7bfc460dd796c04de9b6978ccbda82e8189eca1e5606e282ff","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5466d75206556ff1585574b133e851a9ed1bed9af06a31c2ddf1d4b028a960d8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-26T16:26:23Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-26T16:26:23Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-26T16:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5466d75206556ff1585574b133e851a9ed1bed9af06a31c2ddf1d4b028a960d8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a0a49b0c44daf5eac0a28eb8fc4a58218f346e70d3aaad3f6e4f31227cbe3897","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5466d75206556ff1585574b133e851a9ed1bed9af06a31c2ddf1d4b028a960d8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5466d75206556ff1585574b133e851a9ed1bed9af06a31c2ddf1d4b028a960d8","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-26T16:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5466d75206556ff1585574b133e851a9ed1bed9af06a31c2ddf1d4b028a960d8"}
{"level":"debug","ts":"2026-07-26T16:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"89059489c288e774a9d12c75e864557bb4952a1db0ec981ca8382c9a747d3a8b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-26T16:26:23Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-26T16:26:23Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-26T16:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"89059489c288e774a9d12c75e864557bb4952a1db0ec981ca8382c9a747d3a8b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5466d75206556ff1585574b133e851a9ed1bed9af06a31c2ddf1d4b028a960d8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-26T16:26:23Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-26T16:26:23Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["5466d75206556ff1585574b133e851a9ed1bed9af06a31c2ddf1d4b028a960d8"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-26T16:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5466d75206556ff1585574b133e851a9ed1bed9af06a31c2ddf1d4b028a960d8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"89059489c288e774a9d12c75e864557bb4952a1db0ec981ca8382c9a747d3a8b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5466d75206556ff1585574b133e851a9ed1bed9af06a31c2ddf1d4b028a960d8","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-26T16:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a0a49b0c44daf5eac0a28eb8fc4a58218f346e70d3aaad3f6e4f31227cbe3897"}
{"level":"debug","ts":"2026-07-26T16:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"89059489c288e774a9d12c75e864557bb4952a1db0ec981ca8382c9a747d3a8b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"89059489c288e774a9d12c75e864557bb4952a1db0ec981ca8382c9a747d3a8b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-26T16:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6af4f43925a2ef7bfc460dd796c04de9b6978ccbda82e8189eca1e5606e282ff"}
{"level":"info","ts":"2026-07-26T16:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5466d75206556ff1585574b133e851a9ed1bed9af06a31c2ddf1d4b028a960d8"}
{"level":"debug","ts":"2026-07-26T16:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6cc0bc96a2d53ce0da8f9661d60992f914d1723ba14aeb683d3e3314e1395bca","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-26T16:26:23Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-26T16:26:23Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-26T16:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6cc0bc96a2d53ce0da8f9661d60992f914d1723ba14aeb683d3e3314e1395bca","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"89059489c288e774a9d12c75e864557bb4952a1db0ec981ca8382c9a747d3a8b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-26T16:26:23Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-26T16:26:23Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-26T16:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/89059489c288e774a9d12c75e864557bb4952a1db0ec981ca8382c9a747d3a8b"}
{"level":"info","ts":"2026-07-26T16:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"89059489c288e774a9d12c75e864557bb4952a1db0ec981ca8382c9a747d3a8b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6cc0bc96a2d53ce0da8f9661d60992f914d1723ba14aeb683d3e3314e1395bca","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-26T16:26:23Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-26T16:26:23Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-26T16:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6cc0bc96a2d53ce0da8f9661d60992f914d1723ba14aeb683d3e3314e1395bca"}
{"level":"info","ts":"2026-07-26T16:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6cc0bc96a2d53ce0da8f9661d60992f914d1723ba14aeb683d3e3314e1395bca","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"89059489c288e774a9d12c75e864557bb4952a1db0ec981ca8382c9a747d3a8b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6cc0bc96a2d53ce0da8f9661d60992f914d1723ba14aeb683d3e3314e1395bca","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-26T16:26:23Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-26T16:26:23Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["6cc0bc96a2d53ce0da8f9661d60992f914d1723ba14aeb683d3e3314e1395bca"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-26T16:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6cc0bc96a2d53ce0da8f9661d60992f914d1723ba14aeb683d3e3314e1395bca","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6cc0bc96a2d53ce0da8f9661d60992f914d1723ba14aeb683d3e3314e1395bca","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-26T16:26:23Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-26T16:26:23Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["6cc0bc96a2d53ce0da8f9661d60992f914d1723ba14aeb683d3e3314e1395bca"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-26T16:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/89059489c288e774a9d12c75e864557bb4952a1db0ec981ca8382c9a747d3a8b"}
{"level":"error","ts":"2026-07-26T16:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"6cc0bc96a2d53ce0da8f9661d60992f914d1723ba14aeb683d3e3314e1395bca","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"6cc0bc96a2d53ce0da8f9661d60992f914d1723ba14aeb683d3e3314e1395bca\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-26T16:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6cc0bc96a2d53ce0da8f9661d60992f914d1723ba14aeb683d3e3314e1395bca","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-26T16:26:23Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-26T16:26:23Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-26T16:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6cc0bc96a2d53ce0da8f9661d60992f914d1723ba14aeb683d3e3314e1395bca","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6cc0bc96a2d53ce0da8f9661d60992f914d1723ba14aeb683d3e3314e1395bca","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-26T16:26:23Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-26T16:26:23Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-26T16:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6cc0bc96a2d53ce0da8f9661d60992f914d1723ba14aeb683d3e3314e1395bca"}
{"level":"error","ts":"2026-07-26T16:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"6cc0bc96a2d53ce0da8f9661d60992f914d1723ba14aeb683d3e3314e1395bca","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"6cc0bc96a2d53ce0da8f9661d60992f914d1723ba14aeb683d3e3314e1395bca\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-26T16:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6cc0bc96a2d53ce0da8f9661d60992f914d1723ba14aeb683d3e3314e1395bca","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6cc0bc96a2d53ce0da8f9661d60992f914d1723ba14aeb683d3e3314e1395bca","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-26T16:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6cc0bc96a2d53ce0da8f9661d60992f914d1723ba14aeb683d3e3314e1395bca"}
{"level":"debug","ts":"2026-07-26T16:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"89059489c288e774a9d12c75e864557bb4952a1db0ec981ca8382c9a747d3a8b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-26T16:26:23Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-26T16:26:23Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["89059489c288e774a9d12c75e864557bb4952a1db0ec981ca8382c9a747d3a8b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-26T16:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"89059489c288e774a9d12c75e864557bb4952a1db0ec981ca8382c9a747d3a8b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"cb19c4edd1742dd53b65cd2c41c92051656a7ed647938cb5f40ad141643eef94","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-26T16:26:23Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-26T16:26:23Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-26T16:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/cb19c4edd1742dd53b65cd2c41c92051656a7ed647938cb5f40ad141643eef94"}
{"level":"info","ts":"2026-07-26T16:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"cb19c4edd1742dd53b65cd2c41c92051656a7ed647938cb5f40ad141643eef94","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"89059489c288e774a9d12c75e864557bb4952a1db0ec981ca8382c9a747d3a8b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-26T16:26:23Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-26T16:26:23Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-26T16:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/89059489c288e774a9d12c75e864557bb4952a1db0ec981ca8382c9a747d3a8b"}
{"level":"info","ts":"2026-07-26T16:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"89059489c288e774a9d12c75e864557bb4952a1db0ec981ca8382c9a747d3a8b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"cb19c4edd1742dd53b65cd2c41c92051656a7ed647938cb5f40ad141643eef94","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"89059489c288e774a9d12c75e864557bb4952a1db0ec981ca8382c9a747d3a8b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-26T16:26:23Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-26T16:26:23Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["89059489c288e774a9d12c75e864557bb4952a1db0ec981ca8382c9a747d3a8b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-26T16:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/cb19c4edd1742dd53b65cd2c41c92051656a7ed647938cb5f40ad141643eef94"}
{"level":"info","ts":"2026-07-26T16:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"89059489c288e774a9d12c75e864557bb4952a1db0ec981ca8382c9a747d3a8b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6cc0bc96a2d53ce0da8f9661d60992f914d1723ba14aeb683d3e3314e1395bca","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-26T16:26:23Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-26T16:26:23Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["6cc0bc96a2d53ce0da8f9661d60992f914d1723ba14aeb683d3e3314e1395bca"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-26T16:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6cc0bc96a2d53ce0da8f9661d60992f914d1723ba14aeb683d3e3314e1395bca","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"cb19c4edd1742dd53b65cd2c41c92051656a7ed647938cb5f40ad141643eef94","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-26T16:26:23Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-26T16:26:23Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["cb19c4edd1742dd53b65cd2c41c92051656a7ed647938cb5f40ad141643eef94"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-26T16:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/89059489c288e774a9d12c75e864557bb4952a1db0ec981ca8382c9a747d3a8b"}
{"level":"info","ts":"2026-07-26T16:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"cb19c4edd1742dd53b65cd2c41c92051656a7ed647938cb5f40ad141643eef94","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"89059489c288e774a9d12c75e864557bb4952a1db0ec981ca8382c9a747d3a8b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6cc0bc96a2d53ce0da8f9661d60992f914d1723ba14aeb683d3e3314e1395bca","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-26T16:26:23Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-26T16:26:23Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-26T16:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6cc0bc96a2d53ce0da8f9661d60992f914d1723ba14aeb683d3e3314e1395bca"}
{"level":"info","ts":"2026-07-26T16:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/89059489c288e774a9d12c75e864557bb4952a1db0ec981ca8382c9a747d3a8b"}
{"level":"info","ts":"2026-07-26T16:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6cc0bc96a2d53ce0da8f9661d60992f914d1723ba14aeb683d3e3314e1395bca","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:26:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"05a5027b7f08e5af5f4055ae7a4e62af28892119b94977f8dcf577d245ffaf43","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-26T16:26:23Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-26T16:26:23Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-26T16:26:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/05a5027b7f08e5af5f4055ae7a4e62af28892119b94977f8dcf577d245ffaf43"}
{"level":"info","ts":"2026-07-26T16:26:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/cb19c4edd1742dd53b65cd2c41c92051656a7ed647938cb5f40ad141643eef94"}
{"level":"info","ts":"2026-07-26T16:26:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ac2d0bd70631f75435d3eca77e62ac6d667fb37d8d988e96299f95e2d0b7c4ba"}
{"level":"info","ts":"2026-07-26T16:26:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"05a5027b7f08e5af5f4055ae7a4e62af28892119b94977f8dcf577d245ffaf43","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:26:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"cb19c4edd1742dd53b65cd2c41c92051656a7ed647938cb5f40ad141643eef94","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:26:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ac2d0bd70631f75435d3eca77e62ac6d667fb37d8d988e96299f95e2d0b7c4ba","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-26T16:26:24Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-26T16:26:24Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["ac2d0bd70631f75435d3eca77e62ac6d667fb37d8d988e96299f95e2d0b7c4ba"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-26T16:26:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6cc0bc96a2d53ce0da8f9661d60992f914d1723ba14aeb683d3e3314e1395bca"}
{"level":"info","ts":"2026-07-26T16:26:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/05a5027b7f08e5af5f4055ae7a4e62af28892119b94977f8dcf577d245ffaf43"}
{"level":"info","ts":"2026-07-26T16:26:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ac2d0bd70631f75435d3eca77e62ac6d667fb37d8d988e96299f95e2d0b7c4ba","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:26:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6cc0bc96a2d53ce0da8f9661d60992f914d1723ba14aeb683d3e3314e1395bca","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-26T16:26:24Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-26T16:26:24Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["6cc0bc96a2d53ce0da8f9661d60992f914d1723ba14aeb683d3e3314e1395bca"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-26T16:26:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ac2d0bd70631f75435d3eca77e62ac6d667fb37d8d988e96299f95e2d0b7c4ba"}
{"level":"info","ts":"2026-07-26T16:26:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6cc0bc96a2d53ce0da8f9661d60992f914d1723ba14aeb683d3e3314e1395bca","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:26:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"05a5027b7f08e5af5f4055ae7a4e62af28892119b94977f8dcf577d245ffaf43","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-26T16:26:24Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-26T16:26:24Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["05a5027b7f08e5af5f4055ae7a4e62af28892119b94977f8dcf577d245ffaf43"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-26T16:26:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6cc0bc96a2d53ce0da8f9661d60992f914d1723ba14aeb683d3e3314e1395bca"}
{"level":"info","ts":"2026-07-26T16:26:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"05a5027b7f08e5af5f4055ae7a4e62af28892119b94977f8dcf577d245ffaf43","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:26:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ac2d0bd70631f75435d3eca77e62ac6d667fb37d8d988e96299f95e2d0b7c4ba","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:26:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6cc0bc96a2d53ce0da8f9661d60992f914d1723ba14aeb683d3e3314e1395bca","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-26T16:26:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"05a5027b7f08e5af5f4055ae7a4e62af28892119b94977f8dcf577d245ffaf43","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-26T16:26:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/05a5027b7f08e5af5f4055ae7a4e62af28892119b94977f8dcf577d245ffaf43"}
{"level":"info","ts":"2026-07-26T16:26:41Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"80ac693c-cdbe-4070-ba38-0514c3a68430","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:46796","PortSpecifier":{"PortValue":46796}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.75:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"80ac693c-cdbe-4070-ba38-0514c3a68430","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-ipp-a-10e721.apps.4c5817f4-713b-4eab-97fd-3d8252b1e299.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-26T16:26:41Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"80ac693c-cdbe-4070-ba38-0514c3a68430","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:46796","PortSpecifier":{"PortValue":46796}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.75:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785083201,"nanos":481624570},"http":{"id":"80ac693c-cdbe-4070-ba38-0514c3a68430","method":"POST","headers":{":authority":"e2e-ipp-a-10e721.apps.4c5817f4-713b-4eab-97fd-3d8252b1e299.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-26T16:26:41Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"80ac693c-cdbe-4070-ba38-0514c3a68430","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-26T16:26:41Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"80ac693c-cdbe-4070-ba38-0514c3a68430","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"152070b3-08f0-451d-a549-25cf7f44a8bd","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=365ca425-c8f4-4347-a44f-32434e7dc959"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/3d8252b1e299"]}}
{"level":"debug","ts":"2026-07-26T16:26:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"80ac693c-cdbe-4070-ba38-0514c3a68430","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/3d8252b1e299"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=365ca425-c8f4-4347-a44f-32434e7dc959"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"152070b3-08f0-451d-a549-25cf7f44a8bd","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"a0a49b0c44daf5eac0a28eb8fc4a58218f346e70d3aaad3f6e4f31227cbe3897"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.75:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-ipp-a-10e721.apps.4c5817f4-713b-4eab-97fd-3d8252b1e299.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-26T16:26:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"80ac693c-cdbe-4070-ba38-0514c3a68430","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-26T16:26:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"80ac693c-cdbe-4070-ba38-0514c3a68430","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-26T16:26:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"80ac693c-cdbe-4070-ba38-0514c3a68430","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-ipp-a-10e721/ipp-route-10e721\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-ipp-a-10e721/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-26T16:26:41Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"80ac693c-cdbe-4070-ba38-0514c3a68430","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-26T16:26:41Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"80ac693c-cdbe-4070-ba38-0514c3a68430","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-26T16:26:41Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"80ac693c-cdbe-4070-ba38-0514c3a68430","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-26T16:26:41Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"80ac693c-cdbe-4070-ba38-0514c3a68430","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-26T16:26:41Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"80ac693c-cdbe-4070-ba38-0514c3a68430","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-26T16:26:43Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"07e791f8-0bf6-4992-abfe-bc7b3ec3eaf3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:46806","PortSpecifier":{"PortValue":46806}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.75:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"07e791f8-0bf6-4992-abfe-bc7b3ec3eaf3","method":"POST","path":"/ai-tenant-e2e-ipp-a-10e721/ipp-route-10e721/v1/chat/completions","host":"e2e-ipp-a-10e721.apps.4c5817f4-713b-4eab-97fd-3d8252b1e299.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-26T16:26:43Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"07e791f8-0bf6-4992-abfe-bc7b3ec3eaf3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.11:46806","PortSpecifier":{"PortValue":46806}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.75:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785083203,"nanos":545149377},"http":{"id":"07e791f8-0bf6-4992-abfe-bc7b3ec3eaf3","method":"POST","headers":{":authority":"e2e-ipp-a-10e721.apps.4c5817f4-713b-4eab-97fd-3d8252b1e299.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-ipp-a-10e721/ipp-route-10e721/v1/chat/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-26T16:26:43Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"07e791f8-0bf6-4992-abfe-bc7b3ec3eaf3","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-wsp7Dbel2WWTp9rZ_CMyJD1k3TkAKEeyvlf92eDeo9BsOn0ndQJYn7WHBXfB"}
{"level":"debug","ts":"2026-07-26T16:26:43Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"07e791f8-0bf6-4992-abfe-bc7b3ec3eaf3","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-ipp-a-10e721.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-wsp7Dbel2WWTp9rZ_CMyJD1k3TkAKEeyvlf92eDeo9BsOn0ndQJYn7WHBXfB\"}"}
{"level":"debug","ts":"2026-07-26T16:26:43Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"07e791f8-0bf6-4992-abfe-bc7b3ec3eaf3","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-ipp-a-10e721.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"dc48f8da-a0b5-4d3c-8e9c-baa4b4bcc938","keyName":"e2e-ipp-10e721","subscription":"ipp-route-10e721-sub","tenant":"e2e-ipp-a-10e721","userId":"dc48f8da-a0b5-4d3c-8e9c-baa4b4bcc938","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-26T16:26:43Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"07e791f8-0bf6-4992-abfe-bc7b3ec3eaf3","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-ipp-a-10e721.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-ipp-a-10e721/ipp-route-10e721\",\"requestedSubscription\":\"ipp-route-10e721-sub\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-26T16:26:43Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"07e791f8-0bf6-4992-abfe-bc7b3ec3eaf3","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-ipp-a-10e721.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-ipp-a-10e721/models/facebook/opt-125m","name":"ipp-route-10e721","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"ipp-route-10e721-sub","namespace":"ai-tenant-e2e-ipp-a-10e721","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-ipp-a-10e721/ipp-route-10e721"}}
{"level":"debug","ts":"2026-07-26T16:26:43Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"07e791f8-0bf6-4992-abfe-bc7b3ec3eaf3","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-26T16:26:43Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"07e791f8-0bf6-4992-abfe-bc7b3ec3eaf3","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-26T16:26:43Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"07e791f8-0bf6-4992-abfe-bc7b3ec3eaf3","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-26T16:26:43Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"07e791f8-0bf6-4992-abfe-bc7b3ec3eaf3","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-ipp-a-10e721/ipp-route-10e721\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-ipp-a-10e721/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-26T16:26:43Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"07e791f8-0bf6-4992-abfe-bc7b3ec3eaf3","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-26T16:26:43Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"07e791f8-0bf6-4992-abfe-bc7b3ec3eaf3","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"ipp-route-10e721-sub"}
{"level":"debug","ts":"2026-07-26T16:26:43Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"07e791f8-0bf6-4992-abfe-bc7b3ec3eaf3","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-26T16:26:43Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"07e791f8-0bf6-4992-abfe-bc7b3ec3eaf3","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-26T16:26:43Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"07e791f8-0bf6-4992-abfe-bc7b3ec3eaf3","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"dc48f8da-a0b5-4d3c-8e9c-baa4b4bcc938","keyName":"e2e-ipp-10e721","selected_subscription":"ipp-route-10e721-sub","selected_subscription_key":"ai-tenant-e2e-ipp-a-10e721/ipp-route-10e721-sub@ai-tenant-e2e-ipp-a-10e721/ipp-route-10e721","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-ipp-a-10e721/models/facebook/opt-125m","name":"ipp-route-10e721","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"ipp-route-10e721-sub","namespace":"ai-tenant-e2e-ipp-a-10e721","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-ipp-a-10e721/ipp-route-10e721"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-26T16:26:43Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"07e791f8-0bf6-4992-abfe-bc7b3ec3eaf3","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-26T16:26:43Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"07e791f8-0bf6-4992-abfe-bc7b3ec3eaf3","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-26T16:27:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/019ca7b2a581d913ed552786d6edf1e7747b079f75d1710b482a837df47e1978"}
{"level":"info","ts":"2026-07-26T16:27:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/39b92ad049ea17b26706b1b9b0931340d744aa632017ab15a2663f6b5204a82c"}
{"level":"info","ts":"2026-07-26T16:27:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/6af4f43925a2ef7bfc460dd796c04de9b6978ccbda82e8189eca1e5606e282ff"}
{"level":"info","ts":"2026-07-26T16:27:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/6cc0bc96a2d53ce0da8f9661d60992f914d1723ba14aeb683d3e3314e1395bca"}
{"level":"info","ts":"2026-07-26T16:27:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/1a3c775e41329f4b1023786304d2914911e0db316cf47a38bccf94a026f1ca1d"}
{"level":"info","ts":"2026-07-26T16:27:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/fb64f573020ee198cb6e73c065184b9d65f485af909f526fffff531a3c410323"}
{"level":"info","ts":"2026-07-26T16:27:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/05a5027b7f08e5af5f4055ae7a4e62af28892119b94977f8dcf577d245ffaf43"}
{"level":"info","ts":"2026-07-26T16:27:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/5466d75206556ff1585574b133e851a9ed1bed9af06a31c2ddf1d4b028a960d8"}
{"level":"info","ts":"2026-07-26T16:27:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/89059489c288e774a9d12c75e864557bb4952a1db0ec981ca8382c9a747d3a8b"}
{"level":"info","ts":"2026-07-26T16:27:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/a0a49b0c44daf5eac0a28eb8fc4a58218f346e70d3aaad3f6e4f31227cbe3897"}
{"level":"info","ts":"2026-07-26T16:27:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/ac2d0bd70631f75435d3eca77e62ac6d667fb37d8d988e96299f95e2d0b7c4ba"}
{"level":"info","ts":"2026-07-26T16:27:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/cb19c4edd1742dd53b65cd2c41c92051656a7ed647938cb5f40ad141643eef94"}