{"level":"info","ts":"2026-07-16T12:48:59Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8ae3e45d-9b22-4455-a318-cb0afb319618","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.9:59734","PortSpecifier":{"PortValue":59734}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"8ae3e45d-9b22-4455-a318-cb0afb319618","method":"POST","path":"/ai-tenant-e2e-shared-a-cf65e4/rate-test-model-cf65e4/v1/completions","host":"e2e-shared-a-cf65e4.apps.56e63957-e366-4fa5-9a39-a0acea4d0b67.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-16T12:48:59Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8ae3e45d-9b22-4455-a318-cb0afb319618","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.9:59734","PortSpecifier":{"PortValue":59734}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784206139,"nanos":121979345},"http":{"id":"8ae3e45d-9b22-4455-a318-cb0afb319618","method":"POST","headers":{":authority":"e2e-shared-a-cf65e4.apps.56e63957-e366-4fa5-9a39-a0acea4d0b67.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-cf65e4/rate-test-model-cf65e4/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-16T12:48:59Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"8ae3e45d-9b22-4455-a318-cb0afb319618","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-r5zfXGsHBUsJmG92_76zbEy65sFAcfZpjJweFkfwXPlGmdq1qgUd2f0lN6G"}
{"level":"debug","ts":"2026-07-16T12:48:59Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"8ae3e45d-9b22-4455-a318-cb0afb319618","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-cf65e4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-r5zfXGsHBUsJmG92_76zbEy65sFAcfZpjJweFkfwXPlGmdq1qgUd2f0lN6G\"}"}
{"level":"debug","ts":"2026-07-16T12:48:59Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"8ae3e45d-9b22-4455-a318-cb0afb319618","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-cf65e4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"902a9ce7-6b05-406d-bb7e-5559137cbe7c","keyName":"e2e-rate-a-f78e83","subscription":"e2e-rate-iso-a-f78e83","tenant":"e2e-shared-a-cf65e4","userId":"902a9ce7-6b05-406d-bb7e-5559137cbe7c","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-16T12:48:59Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"8ae3e45d-9b22-4455-a318-cb0afb319618","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-cf65e4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-cf65e4/rate-test-model-cf65e4\",\"requestedSubscription\":\"e2e-rate-iso-a-f78e83\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-16T12:48:59Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"8ae3e45d-9b22-4455-a318-cb0afb319618","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-cf65e4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-cf65e4","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-f78e83","namespace":"ai-tenant-e2e-shared-a-cf65e4","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-16T12:48:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"8ae3e45d-9b22-4455-a318-cb0afb319618","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-16T12:48:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8ae3e45d-9b22-4455-a318-cb0afb319618","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T12:48:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8ae3e45d-9b22-4455-a318-cb0afb319618","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T12:48:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8ae3e45d-9b22-4455-a318-cb0afb319618","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-cf65e4/rate-test-model-cf65e4\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-cf65e4/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T12:48:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8ae3e45d-9b22-4455-a318-cb0afb319618","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T12:48:59Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8ae3e45d-9b22-4455-a318-cb0afb319618","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-16T12:48:59Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8ae3e45d-9b22-4455-a318-cb0afb319618","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-f78e83"}
{"level":"debug","ts":"2026-07-16T12:48:59Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8ae3e45d-9b22-4455-a318-cb0afb319618","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-16T12:48:59Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8ae3e45d-9b22-4455-a318-cb0afb319618","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"902a9ce7-6b05-406d-bb7e-5559137cbe7c","keyName":"e2e-rate-a-f78e83","selected_subscription":"e2e-rate-iso-a-f78e83","selected_subscription_key":"ai-tenant-e2e-shared-a-cf65e4/e2e-rate-iso-a-f78e83@ai-tenant-e2e-shared-a-cf65e4/rate-test-model-cf65e4","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-cf65e4","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-f78e83","namespace":"ai-tenant-e2e-shared-a-cf65e4","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-16T12:48:59Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8ae3e45d-9b22-4455-a318-cb0afb319618","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-16T12:48:59Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8ae3e45d-9b22-4455-a318-cb0afb319618","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-16T12:49:00Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a56d8904-3a0f-4096-85f2-47971ddd13d1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.9:59744","PortSpecifier":{"PortValue":59744}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"a56d8904-3a0f-4096-85f2-47971ddd13d1","method":"POST","path":"/ai-tenant-e2e-shared-a-cf65e4/rate-test-model-cf65e4/v1/completions","host":"e2e-shared-a-cf65e4.apps.56e63957-e366-4fa5-9a39-a0acea4d0b67.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-16T12:49:00Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a56d8904-3a0f-4096-85f2-47971ddd13d1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.9:59744","PortSpecifier":{"PortValue":59744}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784206140,"nanos":200595093},"http":{"id":"a56d8904-3a0f-4096-85f2-47971ddd13d1","method":"POST","headers":{":authority":"e2e-shared-a-cf65e4.apps.56e63957-e366-4fa5-9a39-a0acea4d0b67.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-cf65e4/rate-test-model-cf65e4/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-16T12:49:00Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"a56d8904-3a0f-4096-85f2-47971ddd13d1","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-r5zfXGsHBUsJmG92_76zbEy65sFAcfZpjJweFkfwXPlGmdq1qgUd2f0lN6G"}
{"level":"debug","ts":"2026-07-16T12:49:00Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a56d8904-3a0f-4096-85f2-47971ddd13d1","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-cf65e4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-r5zfXGsHBUsJmG92_76zbEy65sFAcfZpjJweFkfwXPlGmdq1qgUd2f0lN6G\"}"}
{"level":"debug","ts":"2026-07-16T12:49:00Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a56d8904-3a0f-4096-85f2-47971ddd13d1","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-cf65e4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"902a9ce7-6b05-406d-bb7e-5559137cbe7c","keyName":"e2e-rate-a-f78e83","subscription":"e2e-rate-iso-a-f78e83","tenant":"e2e-shared-a-cf65e4","userId":"902a9ce7-6b05-406d-bb7e-5559137cbe7c","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-16T12:49:00Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a56d8904-3a0f-4096-85f2-47971ddd13d1","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-cf65e4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-cf65e4/rate-test-model-cf65e4\",\"requestedSubscription\":\"e2e-rate-iso-a-f78e83\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-16T12:49:00Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a56d8904-3a0f-4096-85f2-47971ddd13d1","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-cf65e4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-cf65e4","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-f78e83","namespace":"ai-tenant-e2e-shared-a-cf65e4","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-16T12:49:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"a56d8904-3a0f-4096-85f2-47971ddd13d1","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-16T12:49:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a56d8904-3a0f-4096-85f2-47971ddd13d1","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T12:49:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a56d8904-3a0f-4096-85f2-47971ddd13d1","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T12:49:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a56d8904-3a0f-4096-85f2-47971ddd13d1","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-cf65e4/rate-test-model-cf65e4\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-cf65e4/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T12:49:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a56d8904-3a0f-4096-85f2-47971ddd13d1","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T12:49:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a56d8904-3a0f-4096-85f2-47971ddd13d1","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-16T12:49:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a56d8904-3a0f-4096-85f2-47971ddd13d1","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-f78e83"}
{"level":"debug","ts":"2026-07-16T12:49:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a56d8904-3a0f-4096-85f2-47971ddd13d1","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-16T12:49:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a56d8904-3a0f-4096-85f2-47971ddd13d1","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"902a9ce7-6b05-406d-bb7e-5559137cbe7c","keyName":"e2e-rate-a-f78e83","selected_subscription":"e2e-rate-iso-a-f78e83","selected_subscription_key":"ai-tenant-e2e-shared-a-cf65e4/e2e-rate-iso-a-f78e83@ai-tenant-e2e-shared-a-cf65e4/rate-test-model-cf65e4","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-cf65e4","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-f78e83","namespace":"ai-tenant-e2e-shared-a-cf65e4","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-16T12:49:00Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a56d8904-3a0f-4096-85f2-47971ddd13d1","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-16T12:49:00Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a56d8904-3a0f-4096-85f2-47971ddd13d1","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-16T12:49:01Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"411ef15d-46c7-4708-9ddb-bf11a112e972","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.9:59760","PortSpecifier":{"PortValue":59760}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"411ef15d-46c7-4708-9ddb-bf11a112e972","method":"POST","path":"/ai-tenant-e2e-shared-a-cf65e4/rate-test-model-cf65e4/v1/completions","host":"e2e-shared-a-cf65e4.apps.56e63957-e366-4fa5-9a39-a0acea4d0b67.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-16T12:49:01Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"411ef15d-46c7-4708-9ddb-bf11a112e972","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.9:59760","PortSpecifier":{"PortValue":59760}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784206141,"nanos":247338334},"http":{"id":"411ef15d-46c7-4708-9ddb-bf11a112e972","method":"POST","headers":{":authority":"e2e-shared-a-cf65e4.apps.56e63957-e366-4fa5-9a39-a0acea4d0b67.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-cf65e4/rate-test-model-cf65e4/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-16T12:49:01Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"411ef15d-46c7-4708-9ddb-bf11a112e972","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-r5zfXGsHBUsJmG92_76zbEy65sFAcfZpjJweFkfwXPlGmdq1qgUd2f0lN6G"}
{"level":"debug","ts":"2026-07-16T12:49:01Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"411ef15d-46c7-4708-9ddb-bf11a112e972","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-cf65e4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-r5zfXGsHBUsJmG92_76zbEy65sFAcfZpjJweFkfwXPlGmdq1qgUd2f0lN6G\"}"}
{"level":"debug","ts":"2026-07-16T12:49:01Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"411ef15d-46c7-4708-9ddb-bf11a112e972","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-cf65e4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"902a9ce7-6b05-406d-bb7e-5559137cbe7c","keyName":"e2e-rate-a-f78e83","subscription":"e2e-rate-iso-a-f78e83","tenant":"e2e-shared-a-cf65e4","userId":"902a9ce7-6b05-406d-bb7e-5559137cbe7c","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-16T12:49:01Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"411ef15d-46c7-4708-9ddb-bf11a112e972","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-cf65e4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-cf65e4/rate-test-model-cf65e4\",\"requestedSubscription\":\"e2e-rate-iso-a-f78e83\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-16T12:49:01Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"411ef15d-46c7-4708-9ddb-bf11a112e972","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-cf65e4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-cf65e4","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-f78e83","namespace":"ai-tenant-e2e-shared-a-cf65e4","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-16T12:49:01Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"411ef15d-46c7-4708-9ddb-bf11a112e972","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-16T12:49:01Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"411ef15d-46c7-4708-9ddb-bf11a112e972","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T12:49:01Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"411ef15d-46c7-4708-9ddb-bf11a112e972","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T12:49:01Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"411ef15d-46c7-4708-9ddb-bf11a112e972","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T12:49:01Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"411ef15d-46c7-4708-9ddb-bf11a112e972","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-cf65e4/rate-test-model-cf65e4\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-cf65e4/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T12:49:01Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"411ef15d-46c7-4708-9ddb-bf11a112e972","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-16T12:49:01Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"411ef15d-46c7-4708-9ddb-bf11a112e972","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-f78e83"}
{"level":"debug","ts":"2026-07-16T12:49:01Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"411ef15d-46c7-4708-9ddb-bf11a112e972","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-16T12:49:01Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"411ef15d-46c7-4708-9ddb-bf11a112e972","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"902a9ce7-6b05-406d-bb7e-5559137cbe7c","keyName":"e2e-rate-a-f78e83","selected_subscription":"e2e-rate-iso-a-f78e83","selected_subscription_key":"ai-tenant-e2e-shared-a-cf65e4/e2e-rate-iso-a-f78e83@ai-tenant-e2e-shared-a-cf65e4/rate-test-model-cf65e4","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-cf65e4","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-f78e83","namespace":"ai-tenant-e2e-shared-a-cf65e4","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-16T12:49:01Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"411ef15d-46c7-4708-9ddb-bf11a112e972","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-16T12:49:01Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"411ef15d-46c7-4708-9ddb-bf11a112e972","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-16T12:49:02Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2ebb0347-2f30-4eb7-a749-b7c684c71275","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.9:59772","PortSpecifier":{"PortValue":59772}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"2ebb0347-2f30-4eb7-a749-b7c684c71275","method":"POST","path":"/ai-tenant-e2e-shared-a-cf65e4/rate-test-model-cf65e4/v1/completions","host":"e2e-shared-a-cf65e4.apps.56e63957-e366-4fa5-9a39-a0acea4d0b67.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-16T12:49:02Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2ebb0347-2f30-4eb7-a749-b7c684c71275","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.9:59772","PortSpecifier":{"PortValue":59772}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784206142,"nanos":289159972},"http":{"id":"2ebb0347-2f30-4eb7-a749-b7c684c71275","method":"POST","headers":{":authority":"e2e-shared-a-cf65e4.apps.56e63957-e366-4fa5-9a39-a0acea4d0b67.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-cf65e4/rate-test-model-cf65e4/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-16T12:49:02Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"2ebb0347-2f30-4eb7-a749-b7c684c71275","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-r5zfXGsHBUsJmG92_76zbEy65sFAcfZpjJweFkfwXPlGmdq1qgUd2f0lN6G"}
{"level":"debug","ts":"2026-07-16T12:49:02Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"2ebb0347-2f30-4eb7-a749-b7c684c71275","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-cf65e4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-r5zfXGsHBUsJmG92_76zbEy65sFAcfZpjJweFkfwXPlGmdq1qgUd2f0lN6G\"}"}
{"level":"debug","ts":"2026-07-16T12:49:02Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"2ebb0347-2f30-4eb7-a749-b7c684c71275","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-cf65e4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"902a9ce7-6b05-406d-bb7e-5559137cbe7c","keyName":"e2e-rate-a-f78e83","subscription":"e2e-rate-iso-a-f78e83","tenant":"e2e-shared-a-cf65e4","userId":"902a9ce7-6b05-406d-bb7e-5559137cbe7c","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-16T12:49:02Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"2ebb0347-2f30-4eb7-a749-b7c684c71275","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-cf65e4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-cf65e4/rate-test-model-cf65e4\",\"requestedSubscription\":\"e2e-rate-iso-a-f78e83\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-16T12:49:02Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"2ebb0347-2f30-4eb7-a749-b7c684c71275","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-cf65e4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-cf65e4","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-f78e83","namespace":"ai-tenant-e2e-shared-a-cf65e4","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-16T12:49:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"2ebb0347-2f30-4eb7-a749-b7c684c71275","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-16T12:49:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2ebb0347-2f30-4eb7-a749-b7c684c71275","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T12:49:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2ebb0347-2f30-4eb7-a749-b7c684c71275","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T12:49:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2ebb0347-2f30-4eb7-a749-b7c684c71275","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-cf65e4/rate-test-model-cf65e4\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-cf65e4/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T12:49:02Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2ebb0347-2f30-4eb7-a749-b7c684c71275","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T12:49:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2ebb0347-2f30-4eb7-a749-b7c684c71275","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-16T12:49:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2ebb0347-2f30-4eb7-a749-b7c684c71275","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-16T12:49:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2ebb0347-2f30-4eb7-a749-b7c684c71275","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-f78e83"}
{"level":"debug","ts":"2026-07-16T12:49:02Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2ebb0347-2f30-4eb7-a749-b7c684c71275","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"902a9ce7-6b05-406d-bb7e-5559137cbe7c","keyName":"e2e-rate-a-f78e83","selected_subscription":"e2e-rate-iso-a-f78e83","selected_subscription_key":"ai-tenant-e2e-shared-a-cf65e4/e2e-rate-iso-a-f78e83@ai-tenant-e2e-shared-a-cf65e4/rate-test-model-cf65e4","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-cf65e4","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-f78e83","namespace":"ai-tenant-e2e-shared-a-cf65e4","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-16T12:49:02Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2ebb0347-2f30-4eb7-a749-b7c684c71275","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-16T12:49:02Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2ebb0347-2f30-4eb7-a749-b7c684c71275","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-16T12:49:03Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e1e79821-588e-4016-ac50-d62d8f81fd28","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.9:59786","PortSpecifier":{"PortValue":59786}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"e1e79821-588e-4016-ac50-d62d8f81fd28","method":"POST","path":"/ai-tenant-e2e-shared-a-cf65e4/rate-test-model-cf65e4/v1/completions","host":"e2e-shared-a-cf65e4.apps.56e63957-e366-4fa5-9a39-a0acea4d0b67.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-16T12:49:03Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e1e79821-588e-4016-ac50-d62d8f81fd28","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.9:59786","PortSpecifier":{"PortValue":59786}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784206143,"nanos":333985622},"http":{"id":"e1e79821-588e-4016-ac50-d62d8f81fd28","method":"POST","headers":{":authority":"e2e-shared-a-cf65e4.apps.56e63957-e366-4fa5-9a39-a0acea4d0b67.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-cf65e4/rate-test-model-cf65e4/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-16T12:49:03Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"e1e79821-588e-4016-ac50-d62d8f81fd28","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-r5zfXGsHBUsJmG92_76zbEy65sFAcfZpjJweFkfwXPlGmdq1qgUd2f0lN6G"}
{"level":"debug","ts":"2026-07-16T12:49:03Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"e1e79821-588e-4016-ac50-d62d8f81fd28","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-cf65e4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-r5zfXGsHBUsJmG92_76zbEy65sFAcfZpjJweFkfwXPlGmdq1qgUd2f0lN6G\"}"}
{"level":"debug","ts":"2026-07-16T12:49:03Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"e1e79821-588e-4016-ac50-d62d8f81fd28","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-cf65e4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"902a9ce7-6b05-406d-bb7e-5559137cbe7c","keyName":"e2e-rate-a-f78e83","subscription":"e2e-rate-iso-a-f78e83","tenant":"e2e-shared-a-cf65e4","userId":"902a9ce7-6b05-406d-bb7e-5559137cbe7c","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-16T12:49:03Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"e1e79821-588e-4016-ac50-d62d8f81fd28","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-cf65e4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-cf65e4/rate-test-model-cf65e4\",\"requestedSubscription\":\"e2e-rate-iso-a-f78e83\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-16T12:49:03Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"e1e79821-588e-4016-ac50-d62d8f81fd28","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-cf65e4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-cf65e4","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-f78e83","namespace":"ai-tenant-e2e-shared-a-cf65e4","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-16T12:49:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"e1e79821-588e-4016-ac50-d62d8f81fd28","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-16T12:49:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e1e79821-588e-4016-ac50-d62d8f81fd28","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T12:49:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e1e79821-588e-4016-ac50-d62d8f81fd28","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T12:49:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e1e79821-588e-4016-ac50-d62d8f81fd28","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T12:49:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e1e79821-588e-4016-ac50-d62d8f81fd28","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-cf65e4/rate-test-model-cf65e4\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-cf65e4/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T12:49:03Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e1e79821-588e-4016-ac50-d62d8f81fd28","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-f78e83"}
{"level":"debug","ts":"2026-07-16T12:49:03Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e1e79821-588e-4016-ac50-d62d8f81fd28","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-16T12:49:03Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e1e79821-588e-4016-ac50-d62d8f81fd28","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-16T12:49:03Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e1e79821-588e-4016-ac50-d62d8f81fd28","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"902a9ce7-6b05-406d-bb7e-5559137cbe7c","keyName":"e2e-rate-a-f78e83","selected_subscription":"e2e-rate-iso-a-f78e83","selected_subscription_key":"ai-tenant-e2e-shared-a-cf65e4/e2e-rate-iso-a-f78e83@ai-tenant-e2e-shared-a-cf65e4/rate-test-model-cf65e4","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-cf65e4","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-f78e83","namespace":"ai-tenant-e2e-shared-a-cf65e4","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-16T12:49:03Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e1e79821-588e-4016-ac50-d62d8f81fd28","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-16T12:49:03Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e1e79821-588e-4016-ac50-d62d8f81fd28","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-16T12:49:04Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1a906721-ad02-41ec-ba83-9cf3f2234d6a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.9:59788","PortSpecifier":{"PortValue":59788}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"1a906721-ad02-41ec-ba83-9cf3f2234d6a","method":"POST","path":"/ai-tenant-e2e-shared-a-cf65e4/rate-test-model-cf65e4/v1/completions","host":"e2e-shared-a-cf65e4.apps.56e63957-e366-4fa5-9a39-a0acea4d0b67.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-16T12:49:04Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1a906721-ad02-41ec-ba83-9cf3f2234d6a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.9:59788","PortSpecifier":{"PortValue":59788}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784206144,"nanos":370327717},"http":{"id":"1a906721-ad02-41ec-ba83-9cf3f2234d6a","method":"POST","headers":{":authority":"e2e-shared-a-cf65e4.apps.56e63957-e366-4fa5-9a39-a0acea4d0b67.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-cf65e4/rate-test-model-cf65e4/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-16T12:49:04Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"1a906721-ad02-41ec-ba83-9cf3f2234d6a","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-r5zfXGsHBUsJmG92_76zbEy65sFAcfZpjJweFkfwXPlGmdq1qgUd2f0lN6G"}
{"level":"debug","ts":"2026-07-16T12:49:04Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"1a906721-ad02-41ec-ba83-9cf3f2234d6a","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-cf65e4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-r5zfXGsHBUsJmG92_76zbEy65sFAcfZpjJweFkfwXPlGmdq1qgUd2f0lN6G\"}"}
{"level":"debug","ts":"2026-07-16T12:49:04Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"1a906721-ad02-41ec-ba83-9cf3f2234d6a","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-cf65e4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"902a9ce7-6b05-406d-bb7e-5559137cbe7c","keyName":"e2e-rate-a-f78e83","subscription":"e2e-rate-iso-a-f78e83","tenant":"e2e-shared-a-cf65e4","userId":"902a9ce7-6b05-406d-bb7e-5559137cbe7c","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-16T12:49:04Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"1a906721-ad02-41ec-ba83-9cf3f2234d6a","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-cf65e4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-cf65e4/rate-test-model-cf65e4\",\"requestedSubscription\":\"e2e-rate-iso-a-f78e83\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-16T12:49:04Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"1a906721-ad02-41ec-ba83-9cf3f2234d6a","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-cf65e4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-cf65e4","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-f78e83","namespace":"ai-tenant-e2e-shared-a-cf65e4","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-16T12:49:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"1a906721-ad02-41ec-ba83-9cf3f2234d6a","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-16T12:49:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1a906721-ad02-41ec-ba83-9cf3f2234d6a","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T12:49:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1a906721-ad02-41ec-ba83-9cf3f2234d6a","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T12:49:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1a906721-ad02-41ec-ba83-9cf3f2234d6a","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-cf65e4/rate-test-model-cf65e4\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-cf65e4/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T12:49:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1a906721-ad02-41ec-ba83-9cf3f2234d6a","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T12:49:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1a906721-ad02-41ec-ba83-9cf3f2234d6a","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-16T12:49:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1a906721-ad02-41ec-ba83-9cf3f2234d6a","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-f78e83"}
{"level":"debug","ts":"2026-07-16T12:49:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1a906721-ad02-41ec-ba83-9cf3f2234d6a","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-16T12:49:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1a906721-ad02-41ec-ba83-9cf3f2234d6a","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"902a9ce7-6b05-406d-bb7e-5559137cbe7c","keyName":"e2e-rate-a-f78e83","selected_subscription":"e2e-rate-iso-a-f78e83","selected_subscription_key":"ai-tenant-e2e-shared-a-cf65e4/e2e-rate-iso-a-f78e83@ai-tenant-e2e-shared-a-cf65e4/rate-test-model-cf65e4","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-cf65e4","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-f78e83","namespace":"ai-tenant-e2e-shared-a-cf65e4","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-16T12:49:04Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1a906721-ad02-41ec-ba83-9cf3f2234d6a","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-16T12:49:04Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1a906721-ad02-41ec-ba83-9cf3f2234d6a","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-16T12:49:05Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2492a7d2-4523-4e38-8e6a-6f8660b02eb5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.9:59802","PortSpecifier":{"PortValue":59802}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"2492a7d2-4523-4e38-8e6a-6f8660b02eb5","method":"POST","path":"/ai-tenant-e2e-shared-a-cf65e4/rate-test-model-cf65e4/v1/completions","host":"e2e-shared-a-cf65e4.apps.56e63957-e366-4fa5-9a39-a0acea4d0b67.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-16T12:49:05Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2492a7d2-4523-4e38-8e6a-6f8660b02eb5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.9:59802","PortSpecifier":{"PortValue":59802}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784206145,"nanos":410034163},"http":{"id":"2492a7d2-4523-4e38-8e6a-6f8660b02eb5","method":"POST","headers":{":authority":"e2e-shared-a-cf65e4.apps.56e63957-e366-4fa5-9a39-a0acea4d0b67.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-cf65e4/rate-test-model-cf65e4/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-16T12:49:05Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"2492a7d2-4523-4e38-8e6a-6f8660b02eb5","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-r5zfXGsHBUsJmG92_76zbEy65sFAcfZpjJweFkfwXPlGmdq1qgUd2f0lN6G"}
{"level":"debug","ts":"2026-07-16T12:49:05Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"2492a7d2-4523-4e38-8e6a-6f8660b02eb5","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-cf65e4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-r5zfXGsHBUsJmG92_76zbEy65sFAcfZpjJweFkfwXPlGmdq1qgUd2f0lN6G\"}"}
{"level":"debug","ts":"2026-07-16T12:49:05Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"2492a7d2-4523-4e38-8e6a-6f8660b02eb5","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-cf65e4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"902a9ce7-6b05-406d-bb7e-5559137cbe7c","keyName":"e2e-rate-a-f78e83","subscription":"e2e-rate-iso-a-f78e83","tenant":"e2e-shared-a-cf65e4","userId":"902a9ce7-6b05-406d-bb7e-5559137cbe7c","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-16T12:49:05Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"2492a7d2-4523-4e38-8e6a-6f8660b02eb5","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-cf65e4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-cf65e4/rate-test-model-cf65e4\",\"requestedSubscription\":\"e2e-rate-iso-a-f78e83\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-16T12:49:05Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"2492a7d2-4523-4e38-8e6a-6f8660b02eb5","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-cf65e4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-cf65e4","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-f78e83","namespace":"ai-tenant-e2e-shared-a-cf65e4","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-16T12:49:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"2492a7d2-4523-4e38-8e6a-6f8660b02eb5","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-16T12:49:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2492a7d2-4523-4e38-8e6a-6f8660b02eb5","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T12:49:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2492a7d2-4523-4e38-8e6a-6f8660b02eb5","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T12:49:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2492a7d2-4523-4e38-8e6a-6f8660b02eb5","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-cf65e4/rate-test-model-cf65e4\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-cf65e4/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T12:49:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2492a7d2-4523-4e38-8e6a-6f8660b02eb5","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T12:49:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2492a7d2-4523-4e38-8e6a-6f8660b02eb5","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-f78e83"}
{"level":"debug","ts":"2026-07-16T12:49:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2492a7d2-4523-4e38-8e6a-6f8660b02eb5","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-16T12:49:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2492a7d2-4523-4e38-8e6a-6f8660b02eb5","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-16T12:49:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2492a7d2-4523-4e38-8e6a-6f8660b02eb5","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"902a9ce7-6b05-406d-bb7e-5559137cbe7c","keyName":"e2e-rate-a-f78e83","selected_subscription":"e2e-rate-iso-a-f78e83","selected_subscription_key":"ai-tenant-e2e-shared-a-cf65e4/e2e-rate-iso-a-f78e83@ai-tenant-e2e-shared-a-cf65e4/rate-test-model-cf65e4","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-cf65e4","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-f78e83","namespace":"ai-tenant-e2e-shared-a-cf65e4","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-16T12:49:05Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2492a7d2-4523-4e38-8e6a-6f8660b02eb5","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-16T12:49:05Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2492a7d2-4523-4e38-8e6a-6f8660b02eb5","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-16T12:49:06Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3dd074fa-e13d-4327-b5c0-583da3ba6f76","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.9:59804","PortSpecifier":{"PortValue":59804}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"3dd074fa-e13d-4327-b5c0-583da3ba6f76","method":"POST","path":"/ai-tenant-e2e-shared-a-cf65e4/rate-test-model-cf65e4/v1/completions","host":"e2e-shared-a-cf65e4.apps.56e63957-e366-4fa5-9a39-a0acea4d0b67.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-16T12:49:06Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3dd074fa-e13d-4327-b5c0-583da3ba6f76","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.9:59804","PortSpecifier":{"PortValue":59804}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784206146,"nanos":450733964},"http":{"id":"3dd074fa-e13d-4327-b5c0-583da3ba6f76","method":"POST","headers":{":authority":"e2e-shared-a-cf65e4.apps.56e63957-e366-4fa5-9a39-a0acea4d0b67.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-cf65e4/rate-test-model-cf65e4/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-16T12:49:06Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"3dd074fa-e13d-4327-b5c0-583da3ba6f76","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-r5zfXGsHBUsJmG92_76zbEy65sFAcfZpjJweFkfwXPlGmdq1qgUd2f0lN6G"}
{"level":"debug","ts":"2026-07-16T12:49:06Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"3dd074fa-e13d-4327-b5c0-583da3ba6f76","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-cf65e4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-r5zfXGsHBUsJmG92_76zbEy65sFAcfZpjJweFkfwXPlGmdq1qgUd2f0lN6G\"}"}
{"level":"debug","ts":"2026-07-16T12:49:06Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"3dd074fa-e13d-4327-b5c0-583da3ba6f76","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-cf65e4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"902a9ce7-6b05-406d-bb7e-5559137cbe7c","keyName":"e2e-rate-a-f78e83","subscription":"e2e-rate-iso-a-f78e83","tenant":"e2e-shared-a-cf65e4","userId":"902a9ce7-6b05-406d-bb7e-5559137cbe7c","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-16T12:49:06Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"3dd074fa-e13d-4327-b5c0-583da3ba6f76","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-cf65e4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-cf65e4/rate-test-model-cf65e4\",\"requestedSubscription\":\"e2e-rate-iso-a-f78e83\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-16T12:49:06Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"3dd074fa-e13d-4327-b5c0-583da3ba6f76","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-cf65e4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-cf65e4","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-f78e83","namespace":"ai-tenant-e2e-shared-a-cf65e4","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-16T12:49:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"3dd074fa-e13d-4327-b5c0-583da3ba6f76","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-16T12:49:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3dd074fa-e13d-4327-b5c0-583da3ba6f76","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T12:49:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3dd074fa-e13d-4327-b5c0-583da3ba6f76","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T12:49:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3dd074fa-e13d-4327-b5c0-583da3ba6f76","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-cf65e4/rate-test-model-cf65e4\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-cf65e4/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T12:49:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3dd074fa-e13d-4327-b5c0-583da3ba6f76","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T12:49:06Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3dd074fa-e13d-4327-b5c0-583da3ba6f76","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-16T12:49:06Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3dd074fa-e13d-4327-b5c0-583da3ba6f76","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-f78e83"}
{"level":"debug","ts":"2026-07-16T12:49:06Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3dd074fa-e13d-4327-b5c0-583da3ba6f76","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-16T12:49:06Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3dd074fa-e13d-4327-b5c0-583da3ba6f76","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"902a9ce7-6b05-406d-bb7e-5559137cbe7c","keyName":"e2e-rate-a-f78e83","selected_subscription":"e2e-rate-iso-a-f78e83","selected_subscription_key":"ai-tenant-e2e-shared-a-cf65e4/e2e-rate-iso-a-f78e83@ai-tenant-e2e-shared-a-cf65e4/rate-test-model-cf65e4","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-cf65e4","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-f78e83","namespace":"ai-tenant-e2e-shared-a-cf65e4","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-16T12:49:06Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3dd074fa-e13d-4327-b5c0-583da3ba6f76","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-16T12:49:06Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3dd074fa-e13d-4327-b5c0-583da3ba6f76","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-16T12:49:07Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f3973660-1199-464d-975c-6708818dcde2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.9:59818","PortSpecifier":{"PortValue":59818}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"f3973660-1199-464d-975c-6708818dcde2","method":"POST","path":"/ai-tenant-e2e-shared-a-cf65e4/rate-test-model-cf65e4/v1/completions","host":"e2e-shared-a-cf65e4.apps.56e63957-e366-4fa5-9a39-a0acea4d0b67.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-16T12:49:07Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f3973660-1199-464d-975c-6708818dcde2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.9:59818","PortSpecifier":{"PortValue":59818}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784206147,"nanos":490084811},"http":{"id":"f3973660-1199-464d-975c-6708818dcde2","method":"POST","headers":{":authority":"e2e-shared-a-cf65e4.apps.56e63957-e366-4fa5-9a39-a0acea4d0b67.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-cf65e4/rate-test-model-cf65e4/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-16T12:49:07Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"f3973660-1199-464d-975c-6708818dcde2","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-r5zfXGsHBUsJmG92_76zbEy65sFAcfZpjJweFkfwXPlGmdq1qgUd2f0lN6G"}
{"level":"debug","ts":"2026-07-16T12:49:07Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"f3973660-1199-464d-975c-6708818dcde2","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-cf65e4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-r5zfXGsHBUsJmG92_76zbEy65sFAcfZpjJweFkfwXPlGmdq1qgUd2f0lN6G\"}"}
{"level":"debug","ts":"2026-07-16T12:49:07Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"f3973660-1199-464d-975c-6708818dcde2","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-cf65e4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"902a9ce7-6b05-406d-bb7e-5559137cbe7c","keyName":"e2e-rate-a-f78e83","subscription":"e2e-rate-iso-a-f78e83","tenant":"e2e-shared-a-cf65e4","userId":"902a9ce7-6b05-406d-bb7e-5559137cbe7c","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-16T12:49:07Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"f3973660-1199-464d-975c-6708818dcde2","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-cf65e4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-cf65e4/rate-test-model-cf65e4\",\"requestedSubscription\":\"e2e-rate-iso-a-f78e83\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-16T12:49:07Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"f3973660-1199-464d-975c-6708818dcde2","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-cf65e4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-cf65e4","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-f78e83","namespace":"ai-tenant-e2e-shared-a-cf65e4","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-16T12:49:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"f3973660-1199-464d-975c-6708818dcde2","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-16T12:49:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f3973660-1199-464d-975c-6708818dcde2","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T12:49:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f3973660-1199-464d-975c-6708818dcde2","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T12:49:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f3973660-1199-464d-975c-6708818dcde2","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T12:49:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f3973660-1199-464d-975c-6708818dcde2","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-cf65e4/rate-test-model-cf65e4\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-cf65e4/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T12:49:07Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f3973660-1199-464d-975c-6708818dcde2","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-f78e83"}
{"level":"debug","ts":"2026-07-16T12:49:07Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f3973660-1199-464d-975c-6708818dcde2","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-16T12:49:07Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f3973660-1199-464d-975c-6708818dcde2","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-16T12:49:07Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f3973660-1199-464d-975c-6708818dcde2","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"902a9ce7-6b05-406d-bb7e-5559137cbe7c","keyName":"e2e-rate-a-f78e83","selected_subscription":"e2e-rate-iso-a-f78e83","selected_subscription_key":"ai-tenant-e2e-shared-a-cf65e4/e2e-rate-iso-a-f78e83@ai-tenant-e2e-shared-a-cf65e4/rate-test-model-cf65e4","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-cf65e4","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-f78e83","namespace":"ai-tenant-e2e-shared-a-cf65e4","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-16T12:49:07Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f3973660-1199-464d-975c-6708818dcde2","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-16T12:49:07Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f3973660-1199-464d-975c-6708818dcde2","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-16T12:49:08Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"871cc722-4146-401b-a0cd-e72cf2709667","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.9:59828","PortSpecifier":{"PortValue":59828}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"871cc722-4146-401b-a0cd-e72cf2709667","method":"POST","path":"/ai-tenant-e2e-shared-a-cf65e4/rate-test-model-cf65e4/v1/completions","host":"e2e-shared-a-cf65e4.apps.56e63957-e366-4fa5-9a39-a0acea4d0b67.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-16T12:49:08Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"871cc722-4146-401b-a0cd-e72cf2709667","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.9:59828","PortSpecifier":{"PortValue":59828}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784206148,"nanos":529663012},"http":{"id":"871cc722-4146-401b-a0cd-e72cf2709667","method":"POST","headers":{":authority":"e2e-shared-a-cf65e4.apps.56e63957-e366-4fa5-9a39-a0acea4d0b67.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-cf65e4/rate-test-model-cf65e4/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-16T12:49:08Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"871cc722-4146-401b-a0cd-e72cf2709667","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-r5zfXGsHBUsJmG92_76zbEy65sFAcfZpjJweFkfwXPlGmdq1qgUd2f0lN6G"}
{"level":"debug","ts":"2026-07-16T12:49:08Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"871cc722-4146-401b-a0cd-e72cf2709667","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-cf65e4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-r5zfXGsHBUsJmG92_76zbEy65sFAcfZpjJweFkfwXPlGmdq1qgUd2f0lN6G\"}"}
{"level":"debug","ts":"2026-07-16T12:49:08Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"871cc722-4146-401b-a0cd-e72cf2709667","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-cf65e4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"902a9ce7-6b05-406d-bb7e-5559137cbe7c","keyName":"e2e-rate-a-f78e83","subscription":"e2e-rate-iso-a-f78e83","tenant":"e2e-shared-a-cf65e4","userId":"902a9ce7-6b05-406d-bb7e-5559137cbe7c","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-16T12:49:08Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"871cc722-4146-401b-a0cd-e72cf2709667","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-cf65e4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-cf65e4/rate-test-model-cf65e4\",\"requestedSubscription\":\"e2e-rate-iso-a-f78e83\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-16T12:49:08Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"871cc722-4146-401b-a0cd-e72cf2709667","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-cf65e4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-cf65e4","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-f78e83","namespace":"ai-tenant-e2e-shared-a-cf65e4","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-16T12:49:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"871cc722-4146-401b-a0cd-e72cf2709667","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-16T12:49:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"871cc722-4146-401b-a0cd-e72cf2709667","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T12:49:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"871cc722-4146-401b-a0cd-e72cf2709667","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T12:49:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"871cc722-4146-401b-a0cd-e72cf2709667","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T12:49:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"871cc722-4146-401b-a0cd-e72cf2709667","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-cf65e4/rate-test-model-cf65e4\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-cf65e4/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T12:49:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"871cc722-4146-401b-a0cd-e72cf2709667","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-16T12:49:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"871cc722-4146-401b-a0cd-e72cf2709667","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-f78e83"}
{"level":"debug","ts":"2026-07-16T12:49:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"871cc722-4146-401b-a0cd-e72cf2709667","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-16T12:49:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"871cc722-4146-401b-a0cd-e72cf2709667","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"902a9ce7-6b05-406d-bb7e-5559137cbe7c","keyName":"e2e-rate-a-f78e83","selected_subscription":"e2e-rate-iso-a-f78e83","selected_subscription_key":"ai-tenant-e2e-shared-a-cf65e4/e2e-rate-iso-a-f78e83@ai-tenant-e2e-shared-a-cf65e4/rate-test-model-cf65e4","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-cf65e4","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-f78e83","namespace":"ai-tenant-e2e-shared-a-cf65e4","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-16T12:49:08Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"871cc722-4146-401b-a0cd-e72cf2709667","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-16T12:49:08Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"871cc722-4146-401b-a0cd-e72cf2709667","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-16T12:49:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"addc415c-52d9-4ca8-a80d-70851d6645f7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.9:55068","PortSpecifier":{"PortValue":55068}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"addc415c-52d9-4ca8-a80d-70851d6645f7","method":"POST","path":"/ai-tenant-e2e-shared-a-cf65e4/rate-test-model-cf65e4/v1/completions","host":"e2e-shared-a-cf65e4.apps.56e63957-e366-4fa5-9a39-a0acea4d0b67.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-16T12:49:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"addc415c-52d9-4ca8-a80d-70851d6645f7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.9:55068","PortSpecifier":{"PortValue":55068}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784206149,"nanos":565090865},"http":{"id":"addc415c-52d9-4ca8-a80d-70851d6645f7","method":"POST","headers":{":authority":"e2e-shared-a-cf65e4.apps.56e63957-e366-4fa5-9a39-a0acea4d0b67.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-cf65e4/rate-test-model-cf65e4/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-16T12:49:09Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"addc415c-52d9-4ca8-a80d-70851d6645f7","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-r5zfXGsHBUsJmG92_76zbEy65sFAcfZpjJweFkfwXPlGmdq1qgUd2f0lN6G"}
{"level":"debug","ts":"2026-07-16T12:49:09Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"addc415c-52d9-4ca8-a80d-70851d6645f7","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-cf65e4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-r5zfXGsHBUsJmG92_76zbEy65sFAcfZpjJweFkfwXPlGmdq1qgUd2f0lN6G\"}"}
{"level":"debug","ts":"2026-07-16T12:49:09Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"addc415c-52d9-4ca8-a80d-70851d6645f7","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-cf65e4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"902a9ce7-6b05-406d-bb7e-5559137cbe7c","keyName":"e2e-rate-a-f78e83","subscription":"e2e-rate-iso-a-f78e83","tenant":"e2e-shared-a-cf65e4","userId":"902a9ce7-6b05-406d-bb7e-5559137cbe7c","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-16T12:49:09Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"addc415c-52d9-4ca8-a80d-70851d6645f7","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-cf65e4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-cf65e4/rate-test-model-cf65e4\",\"requestedSubscription\":\"e2e-rate-iso-a-f78e83\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-16T12:49:09Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"addc415c-52d9-4ca8-a80d-70851d6645f7","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-cf65e4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-cf65e4","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-f78e83","namespace":"ai-tenant-e2e-shared-a-cf65e4","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-16T12:49:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"addc415c-52d9-4ca8-a80d-70851d6645f7","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-16T12:49:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"addc415c-52d9-4ca8-a80d-70851d6645f7","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T12:49:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"addc415c-52d9-4ca8-a80d-70851d6645f7","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T12:49:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"addc415c-52d9-4ca8-a80d-70851d6645f7","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-cf65e4/rate-test-model-cf65e4\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-cf65e4/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T12:49:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"addc415c-52d9-4ca8-a80d-70851d6645f7","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T12:49:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"addc415c-52d9-4ca8-a80d-70851d6645f7","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-16T12:49:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"addc415c-52d9-4ca8-a80d-70851d6645f7","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-16T12:49:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"addc415c-52d9-4ca8-a80d-70851d6645f7","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-f78e83"}
{"level":"debug","ts":"2026-07-16T12:49:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"addc415c-52d9-4ca8-a80d-70851d6645f7","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"902a9ce7-6b05-406d-bb7e-5559137cbe7c","keyName":"e2e-rate-a-f78e83","selected_subscription":"e2e-rate-iso-a-f78e83","selected_subscription_key":"ai-tenant-e2e-shared-a-cf65e4/e2e-rate-iso-a-f78e83@ai-tenant-e2e-shared-a-cf65e4/rate-test-model-cf65e4","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-cf65e4","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-f78e83","namespace":"ai-tenant-e2e-shared-a-cf65e4","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-16T12:49:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"addc415c-52d9-4ca8-a80d-70851d6645f7","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-16T12:49:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"addc415c-52d9-4ca8-a80d-70851d6645f7","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-16T12:49:10Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5f371398-5253-4ff4-970d-8490fad915a8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.9:55078","PortSpecifier":{"PortValue":55078}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"5f371398-5253-4ff4-970d-8490fad915a8","method":"POST","path":"/ai-tenant-e2e-shared-a-cf65e4/rate-test-model-cf65e4/v1/completions","host":"e2e-shared-a-cf65e4.apps.56e63957-e366-4fa5-9a39-a0acea4d0b67.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-16T12:49:10Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5f371398-5253-4ff4-970d-8490fad915a8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.9:55078","PortSpecifier":{"PortValue":55078}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784206150,"nanos":601666240},"http":{"id":"5f371398-5253-4ff4-970d-8490fad915a8","method":"POST","headers":{":authority":"e2e-shared-a-cf65e4.apps.56e63957-e366-4fa5-9a39-a0acea4d0b67.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-cf65e4/rate-test-model-cf65e4/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-16T12:49:10Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"5f371398-5253-4ff4-970d-8490fad915a8","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-r5zfXGsHBUsJmG92_76zbEy65sFAcfZpjJweFkfwXPlGmdq1qgUd2f0lN6G"}
{"level":"debug","ts":"2026-07-16T12:49:10Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"5f371398-5253-4ff4-970d-8490fad915a8","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-cf65e4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-r5zfXGsHBUsJmG92_76zbEy65sFAcfZpjJweFkfwXPlGmdq1qgUd2f0lN6G\"}"}
{"level":"debug","ts":"2026-07-16T12:49:10Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"5f371398-5253-4ff4-970d-8490fad915a8","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-cf65e4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"902a9ce7-6b05-406d-bb7e-5559137cbe7c","keyName":"e2e-rate-a-f78e83","subscription":"e2e-rate-iso-a-f78e83","tenant":"e2e-shared-a-cf65e4","userId":"902a9ce7-6b05-406d-bb7e-5559137cbe7c","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-16T12:49:10Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"5f371398-5253-4ff4-970d-8490fad915a8","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-cf65e4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-cf65e4/rate-test-model-cf65e4\",\"requestedSubscription\":\"e2e-rate-iso-a-f78e83\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-16T12:49:10Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"5f371398-5253-4ff4-970d-8490fad915a8","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-cf65e4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-cf65e4","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-f78e83","namespace":"ai-tenant-e2e-shared-a-cf65e4","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-16T12:49:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"5f371398-5253-4ff4-970d-8490fad915a8","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-16T12:49:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5f371398-5253-4ff4-970d-8490fad915a8","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T12:49:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5f371398-5253-4ff4-970d-8490fad915a8","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T12:49:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5f371398-5253-4ff4-970d-8490fad915a8","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T12:49:10Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5f371398-5253-4ff4-970d-8490fad915a8","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-cf65e4/rate-test-model-cf65e4\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-cf65e4/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T12:49:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5f371398-5253-4ff4-970d-8490fad915a8","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-f78e83"}
{"level":"debug","ts":"2026-07-16T12:49:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5f371398-5253-4ff4-970d-8490fad915a8","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-16T12:49:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5f371398-5253-4ff4-970d-8490fad915a8","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-16T12:49:10Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5f371398-5253-4ff4-970d-8490fad915a8","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"902a9ce7-6b05-406d-bb7e-5559137cbe7c","keyName":"e2e-rate-a-f78e83","selected_subscription":"e2e-rate-iso-a-f78e83","selected_subscription_key":"ai-tenant-e2e-shared-a-cf65e4/e2e-rate-iso-a-f78e83@ai-tenant-e2e-shared-a-cf65e4/rate-test-model-cf65e4","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-cf65e4","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-f78e83","namespace":"ai-tenant-e2e-shared-a-cf65e4","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-16T12:49:10Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5f371398-5253-4ff4-970d-8490fad915a8","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-16T12:49:10Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5f371398-5253-4ff4-970d-8490fad915a8","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-16T12:49:11Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"24ca0ad9-0ec1-4cbb-9dd5-0348a571fdca","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.9:55080","PortSpecifier":{"PortValue":55080}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"24ca0ad9-0ec1-4cbb-9dd5-0348a571fdca","method":"POST","path":"/ai-tenant-e2e-shared-a-cf65e4/rate-test-model-cf65e4/v1/completions","host":"e2e-shared-a-cf65e4.apps.56e63957-e366-4fa5-9a39-a0acea4d0b67.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-16T12:49:11Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"24ca0ad9-0ec1-4cbb-9dd5-0348a571fdca","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.9:55080","PortSpecifier":{"PortValue":55080}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784206151,"nanos":637645483},"http":{"id":"24ca0ad9-0ec1-4cbb-9dd5-0348a571fdca","method":"POST","headers":{":authority":"e2e-shared-a-cf65e4.apps.56e63957-e366-4fa5-9a39-a0acea4d0b67.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-cf65e4/rate-test-model-cf65e4/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-16T12:49:11Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"24ca0ad9-0ec1-4cbb-9dd5-0348a571fdca","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-r5zfXGsHBUsJmG92_76zbEy65sFAcfZpjJweFkfwXPlGmdq1qgUd2f0lN6G"}
{"level":"debug","ts":"2026-07-16T12:49:11Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"24ca0ad9-0ec1-4cbb-9dd5-0348a571fdca","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-cf65e4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-r5zfXGsHBUsJmG92_76zbEy65sFAcfZpjJweFkfwXPlGmdq1qgUd2f0lN6G\"}"}
{"level":"debug","ts":"2026-07-16T12:49:11Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"24ca0ad9-0ec1-4cbb-9dd5-0348a571fdca","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-cf65e4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"902a9ce7-6b05-406d-bb7e-5559137cbe7c","keyName":"e2e-rate-a-f78e83","subscription":"e2e-rate-iso-a-f78e83","tenant":"e2e-shared-a-cf65e4","userId":"902a9ce7-6b05-406d-bb7e-5559137cbe7c","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-16T12:49:11Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"24ca0ad9-0ec1-4cbb-9dd5-0348a571fdca","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-cf65e4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-cf65e4/rate-test-model-cf65e4\",\"requestedSubscription\":\"e2e-rate-iso-a-f78e83\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-16T12:49:11Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"24ca0ad9-0ec1-4cbb-9dd5-0348a571fdca","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-cf65e4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-cf65e4","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-f78e83","namespace":"ai-tenant-e2e-shared-a-cf65e4","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-16T12:49:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"24ca0ad9-0ec1-4cbb-9dd5-0348a571fdca","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-16T12:49:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"24ca0ad9-0ec1-4cbb-9dd5-0348a571fdca","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T12:49:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"24ca0ad9-0ec1-4cbb-9dd5-0348a571fdca","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T12:49:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"24ca0ad9-0ec1-4cbb-9dd5-0348a571fdca","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-cf65e4/rate-test-model-cf65e4\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-cf65e4/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T12:49:11Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"24ca0ad9-0ec1-4cbb-9dd5-0348a571fdca","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T12:49:11Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"24ca0ad9-0ec1-4cbb-9dd5-0348a571fdca","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-16T12:49:11Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"24ca0ad9-0ec1-4cbb-9dd5-0348a571fdca","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-f78e83"}
{"level":"debug","ts":"2026-07-16T12:49:11Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"24ca0ad9-0ec1-4cbb-9dd5-0348a571fdca","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-16T12:49:11Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"24ca0ad9-0ec1-4cbb-9dd5-0348a571fdca","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"902a9ce7-6b05-406d-bb7e-5559137cbe7c","keyName":"e2e-rate-a-f78e83","selected_subscription":"e2e-rate-iso-a-f78e83","selected_subscription_key":"ai-tenant-e2e-shared-a-cf65e4/e2e-rate-iso-a-f78e83@ai-tenant-e2e-shared-a-cf65e4/rate-test-model-cf65e4","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-cf65e4","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-f78e83","namespace":"ai-tenant-e2e-shared-a-cf65e4","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-16T12:49:11Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"24ca0ad9-0ec1-4cbb-9dd5-0348a571fdca","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-16T12:49:11Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"24ca0ad9-0ec1-4cbb-9dd5-0348a571fdca","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-16T12:49:22Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"4ccac4a4-1960-4ab0-85f6-571eda2d99ed","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.9:42156","PortSpecifier":{"PortValue":42156}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"4ccac4a4-1960-4ab0-85f6-571eda2d99ed","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-cf65e4.apps.56e63957-e366-4fa5-9a39-a0acea4d0b67.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-16T12:49:22Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"4ccac4a4-1960-4ab0-85f6-571eda2d99ed","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.9:42156","PortSpecifier":{"PortValue":42156}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784206162,"nanos":662167309},"http":{"id":"4ccac4a4-1960-4ab0-85f6-571eda2d99ed","method":"POST","headers":{":authority":"e2e-shared-a-cf65e4.apps.56e63957-e366-4fa5-9a39-a0acea4d0b67.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-16T12:49:22Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"4ccac4a4-1960-4ab0-85f6-571eda2d99ed","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-16T12:49:22Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"4ccac4a4-1960-4ab0-85f6-571eda2d99ed","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"08635ea3-e0e3-4642-89a5-3da8b62838b4","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=fa3d7477-229b-4fa1-bc04-190f579b6e7c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/a0acea4d0b67"]}}
{"level":"debug","ts":"2026-07-16T12:49:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"4ccac4a4-1960-4ab0-85f6-571eda2d99ed","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/a0acea4d0b67"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=fa3d7477-229b-4fa1-bc04-190f579b6e7c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"08635ea3-e0e3-4642-89a5-3da8b62838b4","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"a9cad8e0d62ad889770ce0987e3a9baf289b961453fc6d5aae7115070f279aad"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.45:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-cf65e4.apps.56e63957-e366-4fa5-9a39-a0acea4d0b67.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-16T12:49:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4ccac4a4-1960-4ab0-85f6-571eda2d99ed","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T12:49:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4ccac4a4-1960-4ab0-85f6-571eda2d99ed","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T12:49:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4ccac4a4-1960-4ab0-85f6-571eda2d99ed","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-cf65e4/rate-test-model-cf65e4\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-cf65e4/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T12:49:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"4ccac4a4-1960-4ab0-85f6-571eda2d99ed","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-16T12:49:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4ccac4a4-1960-4ab0-85f6-571eda2d99ed","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-16T12:49:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4ccac4a4-1960-4ab0-85f6-571eda2d99ed","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-16T12:49:22Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4ccac4a4-1960-4ab0-85f6-571eda2d99ed","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-16T12:49:22Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4ccac4a4-1960-4ab0-85f6-571eda2d99ed","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-16T12:49:22Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"58eb2092-d0ff-4410-a929-098821f3c23c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.9:36800","PortSpecifier":{"PortValue":36800}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.46:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"58eb2092-d0ff-4410-a929-098821f3c23c","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-3c72a3.apps.56e63957-e366-4fa5-9a39-a0acea4d0b67.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-16T12:49:22Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"58eb2092-d0ff-4410-a929-098821f3c23c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.9:36800","PortSpecifier":{"PortValue":36800}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.46:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784206162,"nanos":702502676},"http":{"id":"58eb2092-d0ff-4410-a929-098821f3c23c","method":"POST","headers":{":authority":"e2e-shared-b-3c72a3.apps.56e63957-e366-4fa5-9a39-a0acea4d0b67.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-16T12:49:22Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"58eb2092-d0ff-4410-a929-098821f3c23c","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-16T12:49:22Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"58eb2092-d0ff-4410-a929-098821f3c23c","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"08635ea3-e0e3-4642-89a5-3da8b62838b4","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=fa3d7477-229b-4fa1-bc04-190f579b6e7c"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/a0acea4d0b67"]}}
{"level":"debug","ts":"2026-07-16T12:49:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"58eb2092-d0ff-4410-a929-098821f3c23c","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/a0acea4d0b67"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=fa3d7477-229b-4fa1-bc04-190f579b6e7c"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"08635ea3-e0e3-4642-89a5-3da8b62838b4","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"eeda2e141870831cd50afa2f290bee9f781b7011cf782d58ef96abcdf9109604"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.46:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-3c72a3.apps.56e63957-e366-4fa5-9a39-a0acea4d0b67.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-16T12:49:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"58eb2092-d0ff-4410-a929-098821f3c23c","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T12:49:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"58eb2092-d0ff-4410-a929-098821f3c23c","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T12:49:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"58eb2092-d0ff-4410-a929-098821f3c23c","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-3c72a3/rate-test-model-3c72a3\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-3c72a3/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T12:49:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"58eb2092-d0ff-4410-a929-098821f3c23c","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-16T12:49:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"58eb2092-d0ff-4410-a929-098821f3c23c","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-16T12:49:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"58eb2092-d0ff-4410-a929-098821f3c23c","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-16T12:49:22Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"58eb2092-d0ff-4410-a929-098821f3c23c","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-16T12:49:22Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"58eb2092-d0ff-4410-a929-098821f3c23c","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-16T12:49:22Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9f6f3205-5672-4677-a79e-bd1a7f6aae7a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.9:42164","PortSpecifier":{"PortValue":42164}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"9f6f3205-5672-4677-a79e-bd1a7f6aae7a","method":"POST","path":"/ai-tenant-e2e-shared-a-cf65e4/rate-test-model-cf65e4/v1/completions","host":"e2e-shared-a-cf65e4.apps.56e63957-e366-4fa5-9a39-a0acea4d0b67.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-16T12:49:22Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9f6f3205-5672-4677-a79e-bd1a7f6aae7a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.9:42164","PortSpecifier":{"PortValue":42164}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784206162,"nanos":737668012},"http":{"id":"9f6f3205-5672-4677-a79e-bd1a7f6aae7a","method":"POST","headers":{":authority":"e2e-shared-a-cf65e4.apps.56e63957-e366-4fa5-9a39-a0acea4d0b67.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-cf65e4/rate-test-model-cf65e4/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-16T12:49:22Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"9f6f3205-5672-4677-a79e-bd1a7f6aae7a","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-KZApcNJeMwFZ0X9P_2zi93RNrb0G1bfaqw5KDdqCX5O7VJKMB3uDAm0Nq8sA"}
{"level":"debug","ts":"2026-07-16T12:49:22Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"9f6f3205-5672-4677-a79e-bd1a7f6aae7a","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-cf65e4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-KZApcNJeMwFZ0X9P_2zi93RNrb0G1bfaqw5KDdqCX5O7VJKMB3uDAm0Nq8sA\"}"}
{"level":"debug","ts":"2026-07-16T12:49:22Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"9f6f3205-5672-4677-a79e-bd1a7f6aae7a","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-cf65e4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"cb4a12d1-3756-4797-87d8-a6e82a27c43c","keyName":"e2e-rate-a-a8af01","subscription":"e2e-rate-iso-a-a8af01","tenant":"e2e-shared-a-cf65e4","userId":"cb4a12d1-3756-4797-87d8-a6e82a27c43c","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-16T12:49:22Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"9f6f3205-5672-4677-a79e-bd1a7f6aae7a","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-cf65e4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-cf65e4/rate-test-model-cf65e4\",\"requestedSubscription\":\"e2e-rate-iso-a-a8af01\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-16T12:49:22Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"9f6f3205-5672-4677-a79e-bd1a7f6aae7a","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-cf65e4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-cf65e4","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-a8af01","namespace":"ai-tenant-e2e-shared-a-cf65e4","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-16T12:49:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"9f6f3205-5672-4677-a79e-bd1a7f6aae7a","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-16T12:49:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9f6f3205-5672-4677-a79e-bd1a7f6aae7a","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T12:49:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9f6f3205-5672-4677-a79e-bd1a7f6aae7a","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T12:49:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9f6f3205-5672-4677-a79e-bd1a7f6aae7a","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T12:49:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9f6f3205-5672-4677-a79e-bd1a7f6aae7a","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-cf65e4/rate-test-model-cf65e4\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-cf65e4/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T12:49:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9f6f3205-5672-4677-a79e-bd1a7f6aae7a","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-a8af01"}
{"level":"debug","ts":"2026-07-16T12:49:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9f6f3205-5672-4677-a79e-bd1a7f6aae7a","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-16T12:49:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9f6f3205-5672-4677-a79e-bd1a7f6aae7a","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-16T12:49:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9f6f3205-5672-4677-a79e-bd1a7f6aae7a","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"cb4a12d1-3756-4797-87d8-a6e82a27c43c","keyName":"e2e-rate-a-a8af01","selected_subscription":"e2e-rate-iso-a-a8af01","selected_subscription_key":"ai-tenant-e2e-shared-a-cf65e4/e2e-rate-iso-a-a8af01@ai-tenant-e2e-shared-a-cf65e4/rate-test-model-cf65e4","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-cf65e4","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-a8af01","namespace":"ai-tenant-e2e-shared-a-cf65e4","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-16T12:49:22Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9f6f3205-5672-4677-a79e-bd1a7f6aae7a","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-16T12:49:22Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9f6f3205-5672-4677-a79e-bd1a7f6aae7a","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-16T12:49:23Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6a931814-5293-4760-b928-fb199f12c819","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.9:42166","PortSpecifier":{"PortValue":42166}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"6a931814-5293-4760-b928-fb199f12c819","method":"POST","path":"/ai-tenant-e2e-shared-a-cf65e4/rate-test-model-cf65e4/v1/completions","host":"e2e-shared-a-cf65e4.apps.56e63957-e366-4fa5-9a39-a0acea4d0b67.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-16T12:49:23Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6a931814-5293-4760-b928-fb199f12c819","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.9:42166","PortSpecifier":{"PortValue":42166}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784206163,"nanos":775881876},"http":{"id":"6a931814-5293-4760-b928-fb199f12c819","method":"POST","headers":{":authority":"e2e-shared-a-cf65e4.apps.56e63957-e366-4fa5-9a39-a0acea4d0b67.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-cf65e4/rate-test-model-cf65e4/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-16T12:49:23Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"6a931814-5293-4760-b928-fb199f12c819","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-KZApcNJeMwFZ0X9P_2zi93RNrb0G1bfaqw5KDdqCX5O7VJKMB3uDAm0Nq8sA"}
{"level":"debug","ts":"2026-07-16T12:49:23Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"6a931814-5293-4760-b928-fb199f12c819","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-cf65e4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-KZApcNJeMwFZ0X9P_2zi93RNrb0G1bfaqw5KDdqCX5O7VJKMB3uDAm0Nq8sA\"}"}
{"level":"debug","ts":"2026-07-16T12:49:23Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"6a931814-5293-4760-b928-fb199f12c819","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-cf65e4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"cb4a12d1-3756-4797-87d8-a6e82a27c43c","keyName":"e2e-rate-a-a8af01","subscription":"e2e-rate-iso-a-a8af01","tenant":"e2e-shared-a-cf65e4","userId":"cb4a12d1-3756-4797-87d8-a6e82a27c43c","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-16T12:49:23Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"6a931814-5293-4760-b928-fb199f12c819","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-cf65e4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-cf65e4/rate-test-model-cf65e4\",\"requestedSubscription\":\"e2e-rate-iso-a-a8af01\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-16T12:49:23Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"6a931814-5293-4760-b928-fb199f12c819","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-cf65e4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-cf65e4","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-a8af01","namespace":"ai-tenant-e2e-shared-a-cf65e4","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-16T12:49:23Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"6a931814-5293-4760-b928-fb199f12c819","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-16T12:49:23Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6a931814-5293-4760-b928-fb199f12c819","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T12:49:23Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6a931814-5293-4760-b928-fb199f12c819","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T12:49:23Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6a931814-5293-4760-b928-fb199f12c819","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-cf65e4/rate-test-model-cf65e4\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-cf65e4/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T12:49:23Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6a931814-5293-4760-b928-fb199f12c819","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T12:49:23Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6a931814-5293-4760-b928-fb199f12c819","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-16T12:49:23Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6a931814-5293-4760-b928-fb199f12c819","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-a8af01"}
{"level":"debug","ts":"2026-07-16T12:49:23Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6a931814-5293-4760-b928-fb199f12c819","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-16T12:49:23Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6a931814-5293-4760-b928-fb199f12c819","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"cb4a12d1-3756-4797-87d8-a6e82a27c43c","keyName":"e2e-rate-a-a8af01","selected_subscription":"e2e-rate-iso-a-a8af01","selected_subscription_key":"ai-tenant-e2e-shared-a-cf65e4/e2e-rate-iso-a-a8af01@ai-tenant-e2e-shared-a-cf65e4/rate-test-model-cf65e4","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-cf65e4","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-a8af01","namespace":"ai-tenant-e2e-shared-a-cf65e4","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-16T12:49:23Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6a931814-5293-4760-b928-fb199f12c819","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-16T12:49:23Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6a931814-5293-4760-b928-fb199f12c819","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-16T12:49:24Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"fd9ecd78-7ab3-4f23-b84d-3e60f55e9b78","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.9:42174","PortSpecifier":{"PortValue":42174}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"fd9ecd78-7ab3-4f23-b84d-3e60f55e9b78","method":"POST","path":"/ai-tenant-e2e-shared-a-cf65e4/rate-test-model-cf65e4/v1/completions","host":"e2e-shared-a-cf65e4.apps.56e63957-e366-4fa5-9a39-a0acea4d0b67.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-16T12:49:24Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"fd9ecd78-7ab3-4f23-b84d-3e60f55e9b78","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.9:42174","PortSpecifier":{"PortValue":42174}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784206164,"nanos":811428002},"http":{"id":"fd9ecd78-7ab3-4f23-b84d-3e60f55e9b78","method":"POST","headers":{":authority":"e2e-shared-a-cf65e4.apps.56e63957-e366-4fa5-9a39-a0acea4d0b67.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-cf65e4/rate-test-model-cf65e4/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-16T12:49:24Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"fd9ecd78-7ab3-4f23-b84d-3e60f55e9b78","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-KZApcNJeMwFZ0X9P_2zi93RNrb0G1bfaqw5KDdqCX5O7VJKMB3uDAm0Nq8sA"}
{"level":"debug","ts":"2026-07-16T12:49:24Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"fd9ecd78-7ab3-4f23-b84d-3e60f55e9b78","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-cf65e4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-KZApcNJeMwFZ0X9P_2zi93RNrb0G1bfaqw5KDdqCX5O7VJKMB3uDAm0Nq8sA\"}"}
{"level":"debug","ts":"2026-07-16T12:49:24Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"fd9ecd78-7ab3-4f23-b84d-3e60f55e9b78","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-cf65e4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"cb4a12d1-3756-4797-87d8-a6e82a27c43c","keyName":"e2e-rate-a-a8af01","subscription":"e2e-rate-iso-a-a8af01","tenant":"e2e-shared-a-cf65e4","userId":"cb4a12d1-3756-4797-87d8-a6e82a27c43c","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-16T12:49:24Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"fd9ecd78-7ab3-4f23-b84d-3e60f55e9b78","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-cf65e4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-cf65e4/rate-test-model-cf65e4\",\"requestedSubscription\":\"e2e-rate-iso-a-a8af01\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-16T12:49:24Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"fd9ecd78-7ab3-4f23-b84d-3e60f55e9b78","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-cf65e4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-cf65e4","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-a8af01","namespace":"ai-tenant-e2e-shared-a-cf65e4","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-16T12:49:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"fd9ecd78-7ab3-4f23-b84d-3e60f55e9b78","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-16T12:49:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fd9ecd78-7ab3-4f23-b84d-3e60f55e9b78","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T12:49:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fd9ecd78-7ab3-4f23-b84d-3e60f55e9b78","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T12:49:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fd9ecd78-7ab3-4f23-b84d-3e60f55e9b78","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-cf65e4/rate-test-model-cf65e4\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-cf65e4/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T12:49:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fd9ecd78-7ab3-4f23-b84d-3e60f55e9b78","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T12:49:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"fd9ecd78-7ab3-4f23-b84d-3e60f55e9b78","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-a8af01"}
{"level":"debug","ts":"2026-07-16T12:49:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"fd9ecd78-7ab3-4f23-b84d-3e60f55e9b78","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-16T12:49:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"fd9ecd78-7ab3-4f23-b84d-3e60f55e9b78","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-16T12:49:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"fd9ecd78-7ab3-4f23-b84d-3e60f55e9b78","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"cb4a12d1-3756-4797-87d8-a6e82a27c43c","keyName":"e2e-rate-a-a8af01","selected_subscription":"e2e-rate-iso-a-a8af01","selected_subscription_key":"ai-tenant-e2e-shared-a-cf65e4/e2e-rate-iso-a-a8af01@ai-tenant-e2e-shared-a-cf65e4/rate-test-model-cf65e4","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-cf65e4","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-a8af01","namespace":"ai-tenant-e2e-shared-a-cf65e4","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-16T12:49:24Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"fd9ecd78-7ab3-4f23-b84d-3e60f55e9b78","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-16T12:49:24Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"fd9ecd78-7ab3-4f23-b84d-3e60f55e9b78","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-16T12:49:25Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"4e303e84-c1ad-474e-8238-b80b2df42b83","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.9:42178","PortSpecifier":{"PortValue":42178}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"4e303e84-c1ad-474e-8238-b80b2df42b83","method":"POST","path":"/ai-tenant-e2e-shared-a-cf65e4/rate-test-model-cf65e4/v1/completions","host":"e2e-shared-a-cf65e4.apps.56e63957-e366-4fa5-9a39-a0acea4d0b67.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-16T12:49:25Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"4e303e84-c1ad-474e-8238-b80b2df42b83","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.9:42178","PortSpecifier":{"PortValue":42178}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784206165,"nanos":846067405},"http":{"id":"4e303e84-c1ad-474e-8238-b80b2df42b83","method":"POST","headers":{":authority":"e2e-shared-a-cf65e4.apps.56e63957-e366-4fa5-9a39-a0acea4d0b67.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-cf65e4/rate-test-model-cf65e4/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-16T12:49:25Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"4e303e84-c1ad-474e-8238-b80b2df42b83","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-KZApcNJeMwFZ0X9P_2zi93RNrb0G1bfaqw5KDdqCX5O7VJKMB3uDAm0Nq8sA"}
{"level":"debug","ts":"2026-07-16T12:49:25Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"4e303e84-c1ad-474e-8238-b80b2df42b83","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-cf65e4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-KZApcNJeMwFZ0X9P_2zi93RNrb0G1bfaqw5KDdqCX5O7VJKMB3uDAm0Nq8sA\"}"}
{"level":"debug","ts":"2026-07-16T12:49:25Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"4e303e84-c1ad-474e-8238-b80b2df42b83","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-cf65e4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"cb4a12d1-3756-4797-87d8-a6e82a27c43c","keyName":"e2e-rate-a-a8af01","subscription":"e2e-rate-iso-a-a8af01","tenant":"e2e-shared-a-cf65e4","userId":"cb4a12d1-3756-4797-87d8-a6e82a27c43c","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-16T12:49:25Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"4e303e84-c1ad-474e-8238-b80b2df42b83","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-cf65e4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-cf65e4/rate-test-model-cf65e4\",\"requestedSubscription\":\"e2e-rate-iso-a-a8af01\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-16T12:49:25Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"4e303e84-c1ad-474e-8238-b80b2df42b83","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-cf65e4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-cf65e4","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-a8af01","namespace":"ai-tenant-e2e-shared-a-cf65e4","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-16T12:49:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"4e303e84-c1ad-474e-8238-b80b2df42b83","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-16T12:49:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4e303e84-c1ad-474e-8238-b80b2df42b83","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T12:49:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4e303e84-c1ad-474e-8238-b80b2df42b83","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T12:49:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4e303e84-c1ad-474e-8238-b80b2df42b83","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-cf65e4/rate-test-model-cf65e4\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-cf65e4/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T12:49:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4e303e84-c1ad-474e-8238-b80b2df42b83","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T12:49:25Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4e303e84-c1ad-474e-8238-b80b2df42b83","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-16T12:49:25Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4e303e84-c1ad-474e-8238-b80b2df42b83","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-a8af01"}
{"level":"debug","ts":"2026-07-16T12:49:25Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4e303e84-c1ad-474e-8238-b80b2df42b83","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-16T12:49:25Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4e303e84-c1ad-474e-8238-b80b2df42b83","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"cb4a12d1-3756-4797-87d8-a6e82a27c43c","keyName":"e2e-rate-a-a8af01","selected_subscription":"e2e-rate-iso-a-a8af01","selected_subscription_key":"ai-tenant-e2e-shared-a-cf65e4/e2e-rate-iso-a-a8af01@ai-tenant-e2e-shared-a-cf65e4/rate-test-model-cf65e4","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-cf65e4","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-a8af01","namespace":"ai-tenant-e2e-shared-a-cf65e4","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-16T12:49:25Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4e303e84-c1ad-474e-8238-b80b2df42b83","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-16T12:49:25Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4e303e84-c1ad-474e-8238-b80b2df42b83","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-16T12:49:26Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a48d83f2-c22a-473c-86bf-ed61b09fec7c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.9:42192","PortSpecifier":{"PortValue":42192}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"a48d83f2-c22a-473c-86bf-ed61b09fec7c","method":"POST","path":"/ai-tenant-e2e-shared-a-cf65e4/rate-test-model-cf65e4/v1/completions","host":"e2e-shared-a-cf65e4.apps.56e63957-e366-4fa5-9a39-a0acea4d0b67.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-16T12:49:26Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a48d83f2-c22a-473c-86bf-ed61b09fec7c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.9:42192","PortSpecifier":{"PortValue":42192}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784206166,"nanos":883508185},"http":{"id":"a48d83f2-c22a-473c-86bf-ed61b09fec7c","method":"POST","headers":{":authority":"e2e-shared-a-cf65e4.apps.56e63957-e366-4fa5-9a39-a0acea4d0b67.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-cf65e4/rate-test-model-cf65e4/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-16T12:49:26Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"a48d83f2-c22a-473c-86bf-ed61b09fec7c","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-KZApcNJeMwFZ0X9P_2zi93RNrb0G1bfaqw5KDdqCX5O7VJKMB3uDAm0Nq8sA"}
{"level":"debug","ts":"2026-07-16T12:49:26Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a48d83f2-c22a-473c-86bf-ed61b09fec7c","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-cf65e4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-KZApcNJeMwFZ0X9P_2zi93RNrb0G1bfaqw5KDdqCX5O7VJKMB3uDAm0Nq8sA\"}"}
{"level":"debug","ts":"2026-07-16T12:49:26Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a48d83f2-c22a-473c-86bf-ed61b09fec7c","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-cf65e4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"cb4a12d1-3756-4797-87d8-a6e82a27c43c","keyName":"e2e-rate-a-a8af01","subscription":"e2e-rate-iso-a-a8af01","tenant":"e2e-shared-a-cf65e4","userId":"cb4a12d1-3756-4797-87d8-a6e82a27c43c","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-16T12:49:26Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a48d83f2-c22a-473c-86bf-ed61b09fec7c","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-cf65e4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-cf65e4/rate-test-model-cf65e4\",\"requestedSubscription\":\"e2e-rate-iso-a-a8af01\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-16T12:49:26Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a48d83f2-c22a-473c-86bf-ed61b09fec7c","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-cf65e4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-cf65e4","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-a8af01","namespace":"ai-tenant-e2e-shared-a-cf65e4","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-16T12:49:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"a48d83f2-c22a-473c-86bf-ed61b09fec7c","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-16T12:49:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a48d83f2-c22a-473c-86bf-ed61b09fec7c","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T12:49:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a48d83f2-c22a-473c-86bf-ed61b09fec7c","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T12:49:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a48d83f2-c22a-473c-86bf-ed61b09fec7c","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-cf65e4/rate-test-model-cf65e4\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-cf65e4/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T12:49:26Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a48d83f2-c22a-473c-86bf-ed61b09fec7c","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T12:49:26Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a48d83f2-c22a-473c-86bf-ed61b09fec7c","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-16T12:49:26Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a48d83f2-c22a-473c-86bf-ed61b09fec7c","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-16T12:49:26Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a48d83f2-c22a-473c-86bf-ed61b09fec7c","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-a8af01"}
{"level":"debug","ts":"2026-07-16T12:49:26Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a48d83f2-c22a-473c-86bf-ed61b09fec7c","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"cb4a12d1-3756-4797-87d8-a6e82a27c43c","keyName":"e2e-rate-a-a8af01","selected_subscription":"e2e-rate-iso-a-a8af01","selected_subscription_key":"ai-tenant-e2e-shared-a-cf65e4/e2e-rate-iso-a-a8af01@ai-tenant-e2e-shared-a-cf65e4/rate-test-model-cf65e4","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-cf65e4","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-a8af01","namespace":"ai-tenant-e2e-shared-a-cf65e4","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-16T12:49:26Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a48d83f2-c22a-473c-86bf-ed61b09fec7c","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-16T12:49:26Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a48d83f2-c22a-473c-86bf-ed61b09fec7c","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-16T12:49:27Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3ed9812b-9113-4990-b525-9a043e47bb73","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.9:42196","PortSpecifier":{"PortValue":42196}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"3ed9812b-9113-4990-b525-9a043e47bb73","method":"POST","path":"/ai-tenant-e2e-shared-a-cf65e4/rate-test-model-cf65e4/v1/completions","host":"e2e-shared-a-cf65e4.apps.56e63957-e366-4fa5-9a39-a0acea4d0b67.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-16T12:49:27Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3ed9812b-9113-4990-b525-9a043e47bb73","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.9:42196","PortSpecifier":{"PortValue":42196}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784206167,"nanos":918986036},"http":{"id":"3ed9812b-9113-4990-b525-9a043e47bb73","method":"POST","headers":{":authority":"e2e-shared-a-cf65e4.apps.56e63957-e366-4fa5-9a39-a0acea4d0b67.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-cf65e4/rate-test-model-cf65e4/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-16T12:49:27Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"3ed9812b-9113-4990-b525-9a043e47bb73","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-KZApcNJeMwFZ0X9P_2zi93RNrb0G1bfaqw5KDdqCX5O7VJKMB3uDAm0Nq8sA"}
{"level":"debug","ts":"2026-07-16T12:49:27Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"3ed9812b-9113-4990-b525-9a043e47bb73","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-cf65e4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-KZApcNJeMwFZ0X9P_2zi93RNrb0G1bfaqw5KDdqCX5O7VJKMB3uDAm0Nq8sA\"}"}
{"level":"debug","ts":"2026-07-16T12:49:27Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"3ed9812b-9113-4990-b525-9a043e47bb73","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-cf65e4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"cb4a12d1-3756-4797-87d8-a6e82a27c43c","keyName":"e2e-rate-a-a8af01","subscription":"e2e-rate-iso-a-a8af01","tenant":"e2e-shared-a-cf65e4","userId":"cb4a12d1-3756-4797-87d8-a6e82a27c43c","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-16T12:49:27Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"3ed9812b-9113-4990-b525-9a043e47bb73","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-cf65e4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-cf65e4/rate-test-model-cf65e4\",\"requestedSubscription\":\"e2e-rate-iso-a-a8af01\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-16T12:49:27Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"3ed9812b-9113-4990-b525-9a043e47bb73","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-cf65e4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-cf65e4","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-a8af01","namespace":"ai-tenant-e2e-shared-a-cf65e4","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-16T12:49:27Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"3ed9812b-9113-4990-b525-9a043e47bb73","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-16T12:49:27Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3ed9812b-9113-4990-b525-9a043e47bb73","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T12:49:27Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3ed9812b-9113-4990-b525-9a043e47bb73","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T12:49:27Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3ed9812b-9113-4990-b525-9a043e47bb73","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T12:49:27Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3ed9812b-9113-4990-b525-9a043e47bb73","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-cf65e4/rate-test-model-cf65e4\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-cf65e4/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T12:49:27Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3ed9812b-9113-4990-b525-9a043e47bb73","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-16T12:49:27Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3ed9812b-9113-4990-b525-9a043e47bb73","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-16T12:49:27Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3ed9812b-9113-4990-b525-9a043e47bb73","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-a8af01"}
{"level":"debug","ts":"2026-07-16T12:49:27Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3ed9812b-9113-4990-b525-9a043e47bb73","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"cb4a12d1-3756-4797-87d8-a6e82a27c43c","keyName":"e2e-rate-a-a8af01","selected_subscription":"e2e-rate-iso-a-a8af01","selected_subscription_key":"ai-tenant-e2e-shared-a-cf65e4/e2e-rate-iso-a-a8af01@ai-tenant-e2e-shared-a-cf65e4/rate-test-model-cf65e4","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-cf65e4","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-a8af01","namespace":"ai-tenant-e2e-shared-a-cf65e4","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-16T12:49:27Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3ed9812b-9113-4990-b525-9a043e47bb73","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-16T12:49:27Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3ed9812b-9113-4990-b525-9a043e47bb73","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-16T12:49:28Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a6e16630-bc1e-4a03-8540-f471fa299b1c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.9:46342","PortSpecifier":{"PortValue":46342}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"a6e16630-bc1e-4a03-8540-f471fa299b1c","method":"POST","path":"/ai-tenant-e2e-shared-a-cf65e4/rate-test-model-cf65e4/v1/completions","host":"e2e-shared-a-cf65e4.apps.56e63957-e366-4fa5-9a39-a0acea4d0b67.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-16T12:49:28Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a6e16630-bc1e-4a03-8540-f471fa299b1c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.9:46342","PortSpecifier":{"PortValue":46342}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784206168,"nanos":958998502},"http":{"id":"a6e16630-bc1e-4a03-8540-f471fa299b1c","method":"POST","headers":{":authority":"e2e-shared-a-cf65e4.apps.56e63957-e366-4fa5-9a39-a0acea4d0b67.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-cf65e4/rate-test-model-cf65e4/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-16T12:49:28Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"a6e16630-bc1e-4a03-8540-f471fa299b1c","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-KZApcNJeMwFZ0X9P_2zi93RNrb0G1bfaqw5KDdqCX5O7VJKMB3uDAm0Nq8sA"}
{"level":"debug","ts":"2026-07-16T12:49:28Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a6e16630-bc1e-4a03-8540-f471fa299b1c","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-cf65e4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-KZApcNJeMwFZ0X9P_2zi93RNrb0G1bfaqw5KDdqCX5O7VJKMB3uDAm0Nq8sA\"}"}
{"level":"debug","ts":"2026-07-16T12:49:28Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a6e16630-bc1e-4a03-8540-f471fa299b1c","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-cf65e4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"cb4a12d1-3756-4797-87d8-a6e82a27c43c","keyName":"e2e-rate-a-a8af01","subscription":"e2e-rate-iso-a-a8af01","tenant":"e2e-shared-a-cf65e4","userId":"cb4a12d1-3756-4797-87d8-a6e82a27c43c","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-16T12:49:28Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a6e16630-bc1e-4a03-8540-f471fa299b1c","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-cf65e4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-cf65e4/rate-test-model-cf65e4\",\"requestedSubscription\":\"e2e-rate-iso-a-a8af01\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-16T12:49:28Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a6e16630-bc1e-4a03-8540-f471fa299b1c","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-cf65e4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-cf65e4","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-a8af01","namespace":"ai-tenant-e2e-shared-a-cf65e4","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-16T12:49:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"a6e16630-bc1e-4a03-8540-f471fa299b1c","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-16T12:49:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a6e16630-bc1e-4a03-8540-f471fa299b1c","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T12:49:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a6e16630-bc1e-4a03-8540-f471fa299b1c","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T12:49:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a6e16630-bc1e-4a03-8540-f471fa299b1c","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-cf65e4/rate-test-model-cf65e4\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-cf65e4/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T12:49:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a6e16630-bc1e-4a03-8540-f471fa299b1c","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T12:49:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a6e16630-bc1e-4a03-8540-f471fa299b1c","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-16T12:49:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a6e16630-bc1e-4a03-8540-f471fa299b1c","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-16T12:49:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a6e16630-bc1e-4a03-8540-f471fa299b1c","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-a8af01"}
{"level":"debug","ts":"2026-07-16T12:49:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a6e16630-bc1e-4a03-8540-f471fa299b1c","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"cb4a12d1-3756-4797-87d8-a6e82a27c43c","keyName":"e2e-rate-a-a8af01","selected_subscription":"e2e-rate-iso-a-a8af01","selected_subscription_key":"ai-tenant-e2e-shared-a-cf65e4/e2e-rate-iso-a-a8af01@ai-tenant-e2e-shared-a-cf65e4/rate-test-model-cf65e4","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-cf65e4","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-a8af01","namespace":"ai-tenant-e2e-shared-a-cf65e4","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-16T12:49:28Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a6e16630-bc1e-4a03-8540-f471fa299b1c","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-16T12:49:28Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a6e16630-bc1e-4a03-8540-f471fa299b1c","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-16T12:49:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1da555fc-f14d-4106-adb4-900a1269661a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.9:46352","PortSpecifier":{"PortValue":46352}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"1da555fc-f14d-4106-adb4-900a1269661a","method":"POST","path":"/ai-tenant-e2e-shared-a-cf65e4/rate-test-model-cf65e4/v1/completions","host":"e2e-shared-a-cf65e4.apps.56e63957-e366-4fa5-9a39-a0acea4d0b67.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-16T12:49:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1da555fc-f14d-4106-adb4-900a1269661a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.9:46352","PortSpecifier":{"PortValue":46352}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784206169,"nanos":996299432},"http":{"id":"1da555fc-f14d-4106-adb4-900a1269661a","method":"POST","headers":{":authority":"e2e-shared-a-cf65e4.apps.56e63957-e366-4fa5-9a39-a0acea4d0b67.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-cf65e4/rate-test-model-cf65e4/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-16T12:49:29Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"1da555fc-f14d-4106-adb4-900a1269661a","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-KZApcNJeMwFZ0X9P_2zi93RNrb0G1bfaqw5KDdqCX5O7VJKMB3uDAm0Nq8sA"}
{"level":"debug","ts":"2026-07-16T12:49:29Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"1da555fc-f14d-4106-adb4-900a1269661a","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-cf65e4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-KZApcNJeMwFZ0X9P_2zi93RNrb0G1bfaqw5KDdqCX5O7VJKMB3uDAm0Nq8sA\"}"}
{"level":"debug","ts":"2026-07-16T12:49:29Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"1da555fc-f14d-4106-adb4-900a1269661a","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-cf65e4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"cb4a12d1-3756-4797-87d8-a6e82a27c43c","keyName":"e2e-rate-a-a8af01","subscription":"e2e-rate-iso-a-a8af01","tenant":"e2e-shared-a-cf65e4","userId":"cb4a12d1-3756-4797-87d8-a6e82a27c43c","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-16T12:49:30Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"1da555fc-f14d-4106-adb4-900a1269661a","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-cf65e4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-cf65e4/rate-test-model-cf65e4\",\"requestedSubscription\":\"e2e-rate-iso-a-a8af01\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-16T12:49:30Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"1da555fc-f14d-4106-adb4-900a1269661a","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-cf65e4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-cf65e4","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-a8af01","namespace":"ai-tenant-e2e-shared-a-cf65e4","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-16T12:49:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"1da555fc-f14d-4106-adb4-900a1269661a","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-16T12:49:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1da555fc-f14d-4106-adb4-900a1269661a","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T12:49:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1da555fc-f14d-4106-adb4-900a1269661a","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T12:49:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1da555fc-f14d-4106-adb4-900a1269661a","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-cf65e4/rate-test-model-cf65e4\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-cf65e4/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T12:49:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1da555fc-f14d-4106-adb4-900a1269661a","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T12:49:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1da555fc-f14d-4106-adb4-900a1269661a","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-16T12:49:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1da555fc-f14d-4106-adb4-900a1269661a","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-a8af01"}
{"level":"debug","ts":"2026-07-16T12:49:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1da555fc-f14d-4106-adb4-900a1269661a","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-16T12:49:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1da555fc-f14d-4106-adb4-900a1269661a","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"cb4a12d1-3756-4797-87d8-a6e82a27c43c","keyName":"e2e-rate-a-a8af01","selected_subscription":"e2e-rate-iso-a-a8af01","selected_subscription_key":"ai-tenant-e2e-shared-a-cf65e4/e2e-rate-iso-a-a8af01@ai-tenant-e2e-shared-a-cf65e4/rate-test-model-cf65e4","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-cf65e4","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-a8af01","namespace":"ai-tenant-e2e-shared-a-cf65e4","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-16T12:49:30Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1da555fc-f14d-4106-adb4-900a1269661a","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-16T12:49:30Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1da555fc-f14d-4106-adb4-900a1269661a","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-16T12:49:31Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e9cd50cc-995d-494d-ad1b-1763d602bb79","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.9:46368","PortSpecifier":{"PortValue":46368}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"e9cd50cc-995d-494d-ad1b-1763d602bb79","method":"POST","path":"/ai-tenant-e2e-shared-a-cf65e4/rate-test-model-cf65e4/v1/completions","host":"e2e-shared-a-cf65e4.apps.56e63957-e366-4fa5-9a39-a0acea4d0b67.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-16T12:49:31Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"e9cd50cc-995d-494d-ad1b-1763d602bb79","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.9:46368","PortSpecifier":{"PortValue":46368}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784206171,"nanos":33876711},"http":{"id":"e9cd50cc-995d-494d-ad1b-1763d602bb79","method":"POST","headers":{":authority":"e2e-shared-a-cf65e4.apps.56e63957-e366-4fa5-9a39-a0acea4d0b67.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-cf65e4/rate-test-model-cf65e4/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-16T12:49:31Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"e9cd50cc-995d-494d-ad1b-1763d602bb79","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-KZApcNJeMwFZ0X9P_2zi93RNrb0G1bfaqw5KDdqCX5O7VJKMB3uDAm0Nq8sA"}
{"level":"debug","ts":"2026-07-16T12:49:31Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"e9cd50cc-995d-494d-ad1b-1763d602bb79","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-cf65e4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-KZApcNJeMwFZ0X9P_2zi93RNrb0G1bfaqw5KDdqCX5O7VJKMB3uDAm0Nq8sA\"}"}
{"level":"debug","ts":"2026-07-16T12:49:31Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"e9cd50cc-995d-494d-ad1b-1763d602bb79","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-cf65e4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"cb4a12d1-3756-4797-87d8-a6e82a27c43c","keyName":"e2e-rate-a-a8af01","subscription":"e2e-rate-iso-a-a8af01","tenant":"e2e-shared-a-cf65e4","userId":"cb4a12d1-3756-4797-87d8-a6e82a27c43c","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-16T12:49:31Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"e9cd50cc-995d-494d-ad1b-1763d602bb79","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-cf65e4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-cf65e4/rate-test-model-cf65e4\",\"requestedSubscription\":\"e2e-rate-iso-a-a8af01\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-16T12:49:31Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"e9cd50cc-995d-494d-ad1b-1763d602bb79","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-cf65e4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-cf65e4","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-a8af01","namespace":"ai-tenant-e2e-shared-a-cf65e4","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-16T12:49:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"e9cd50cc-995d-494d-ad1b-1763d602bb79","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-16T12:49:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e9cd50cc-995d-494d-ad1b-1763d602bb79","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T12:49:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e9cd50cc-995d-494d-ad1b-1763d602bb79","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T12:49:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e9cd50cc-995d-494d-ad1b-1763d602bb79","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T12:49:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"e9cd50cc-995d-494d-ad1b-1763d602bb79","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-cf65e4/rate-test-model-cf65e4\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-cf65e4/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T12:49:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e9cd50cc-995d-494d-ad1b-1763d602bb79","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-16T12:49:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e9cd50cc-995d-494d-ad1b-1763d602bb79","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-16T12:49:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e9cd50cc-995d-494d-ad1b-1763d602bb79","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-a8af01"}
{"level":"debug","ts":"2026-07-16T12:49:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"e9cd50cc-995d-494d-ad1b-1763d602bb79","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"cb4a12d1-3756-4797-87d8-a6e82a27c43c","keyName":"e2e-rate-a-a8af01","selected_subscription":"e2e-rate-iso-a-a8af01","selected_subscription_key":"ai-tenant-e2e-shared-a-cf65e4/e2e-rate-iso-a-a8af01@ai-tenant-e2e-shared-a-cf65e4/rate-test-model-cf65e4","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-cf65e4","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-a8af01","namespace":"ai-tenant-e2e-shared-a-cf65e4","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-16T12:49:31Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e9cd50cc-995d-494d-ad1b-1763d602bb79","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-16T12:49:31Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"e9cd50cc-995d-494d-ad1b-1763d602bb79","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-16T12:49:32Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c0adae9b-39ad-443d-92fa-16dfd250fd20","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.9:46378","PortSpecifier":{"PortValue":46378}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"c0adae9b-39ad-443d-92fa-16dfd250fd20","method":"POST","path":"/ai-tenant-e2e-shared-a-cf65e4/rate-test-model-cf65e4/v1/completions","host":"e2e-shared-a-cf65e4.apps.56e63957-e366-4fa5-9a39-a0acea4d0b67.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-16T12:49:32Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c0adae9b-39ad-443d-92fa-16dfd250fd20","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.9:46378","PortSpecifier":{"PortValue":46378}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784206172,"nanos":68394565},"http":{"id":"c0adae9b-39ad-443d-92fa-16dfd250fd20","method":"POST","headers":{":authority":"e2e-shared-a-cf65e4.apps.56e63957-e366-4fa5-9a39-a0acea4d0b67.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-cf65e4/rate-test-model-cf65e4/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-16T12:49:32Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"c0adae9b-39ad-443d-92fa-16dfd250fd20","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-KZApcNJeMwFZ0X9P_2zi93RNrb0G1bfaqw5KDdqCX5O7VJKMB3uDAm0Nq8sA"}
{"level":"debug","ts":"2026-07-16T12:49:32Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"c0adae9b-39ad-443d-92fa-16dfd250fd20","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-cf65e4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-KZApcNJeMwFZ0X9P_2zi93RNrb0G1bfaqw5KDdqCX5O7VJKMB3uDAm0Nq8sA\"}"}
{"level":"debug","ts":"2026-07-16T12:49:32Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"c0adae9b-39ad-443d-92fa-16dfd250fd20","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-cf65e4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"cb4a12d1-3756-4797-87d8-a6e82a27c43c","keyName":"e2e-rate-a-a8af01","subscription":"e2e-rate-iso-a-a8af01","tenant":"e2e-shared-a-cf65e4","userId":"cb4a12d1-3756-4797-87d8-a6e82a27c43c","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-16T12:49:32Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"c0adae9b-39ad-443d-92fa-16dfd250fd20","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-cf65e4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-cf65e4/rate-test-model-cf65e4\",\"requestedSubscription\":\"e2e-rate-iso-a-a8af01\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-16T12:49:32Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"c0adae9b-39ad-443d-92fa-16dfd250fd20","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-cf65e4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-cf65e4","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-a8af01","namespace":"ai-tenant-e2e-shared-a-cf65e4","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-16T12:49:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"c0adae9b-39ad-443d-92fa-16dfd250fd20","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-16T12:49:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c0adae9b-39ad-443d-92fa-16dfd250fd20","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T12:49:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c0adae9b-39ad-443d-92fa-16dfd250fd20","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T12:49:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c0adae9b-39ad-443d-92fa-16dfd250fd20","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T12:49:32Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c0adae9b-39ad-443d-92fa-16dfd250fd20","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-cf65e4/rate-test-model-cf65e4\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-cf65e4/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T12:49:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c0adae9b-39ad-443d-92fa-16dfd250fd20","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-16T12:49:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c0adae9b-39ad-443d-92fa-16dfd250fd20","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-16T12:49:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c0adae9b-39ad-443d-92fa-16dfd250fd20","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-a8af01"}
{"level":"debug","ts":"2026-07-16T12:49:32Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c0adae9b-39ad-443d-92fa-16dfd250fd20","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"cb4a12d1-3756-4797-87d8-a6e82a27c43c","keyName":"e2e-rate-a-a8af01","selected_subscription":"e2e-rate-iso-a-a8af01","selected_subscription_key":"ai-tenant-e2e-shared-a-cf65e4/e2e-rate-iso-a-a8af01@ai-tenant-e2e-shared-a-cf65e4/rate-test-model-cf65e4","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-cf65e4","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-a8af01","namespace":"ai-tenant-e2e-shared-a-cf65e4","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-16T12:49:32Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c0adae9b-39ad-443d-92fa-16dfd250fd20","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-16T12:49:32Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c0adae9b-39ad-443d-92fa-16dfd250fd20","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-16T12:49:33Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8c4c92cd-5fc8-4148-81cf-54023ec29f3e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.9:46382","PortSpecifier":{"PortValue":46382}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"8c4c92cd-5fc8-4148-81cf-54023ec29f3e","method":"POST","path":"/ai-tenant-e2e-shared-a-cf65e4/rate-test-model-cf65e4/v1/completions","host":"e2e-shared-a-cf65e4.apps.56e63957-e366-4fa5-9a39-a0acea4d0b67.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-16T12:49:33Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8c4c92cd-5fc8-4148-81cf-54023ec29f3e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.9:46382","PortSpecifier":{"PortValue":46382}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.45:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784206173,"nanos":102872941},"http":{"id":"8c4c92cd-5fc8-4148-81cf-54023ec29f3e","method":"POST","headers":{":authority":"e2e-shared-a-cf65e4.apps.56e63957-e366-4fa5-9a39-a0acea4d0b67.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-cf65e4/rate-test-model-cf65e4/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-16T12:49:33Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"8c4c92cd-5fc8-4148-81cf-54023ec29f3e","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-KZApcNJeMwFZ0X9P_2zi93RNrb0G1bfaqw5KDdqCX5O7VJKMB3uDAm0Nq8sA"}
{"level":"debug","ts":"2026-07-16T12:49:33Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"8c4c92cd-5fc8-4148-81cf-54023ec29f3e","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-cf65e4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-KZApcNJeMwFZ0X9P_2zi93RNrb0G1bfaqw5KDdqCX5O7VJKMB3uDAm0Nq8sA\"}"}
{"level":"debug","ts":"2026-07-16T12:49:33Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"8c4c92cd-5fc8-4148-81cf-54023ec29f3e","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-cf65e4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"cb4a12d1-3756-4797-87d8-a6e82a27c43c","keyName":"e2e-rate-a-a8af01","subscription":"e2e-rate-iso-a-a8af01","tenant":"e2e-shared-a-cf65e4","userId":"cb4a12d1-3756-4797-87d8-a6e82a27c43c","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-16T12:49:33Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"8c4c92cd-5fc8-4148-81cf-54023ec29f3e","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-cf65e4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-cf65e4/rate-test-model-cf65e4\",\"requestedSubscription\":\"e2e-rate-iso-a-a8af01\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-16T12:49:33Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"8c4c92cd-5fc8-4148-81cf-54023ec29f3e","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-cf65e4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-cf65e4","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-a8af01","namespace":"ai-tenant-e2e-shared-a-cf65e4","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-16T12:49:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"8c4c92cd-5fc8-4148-81cf-54023ec29f3e","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-16T12:49:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8c4c92cd-5fc8-4148-81cf-54023ec29f3e","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T12:49:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8c4c92cd-5fc8-4148-81cf-54023ec29f3e","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T12:49:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8c4c92cd-5fc8-4148-81cf-54023ec29f3e","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T12:49:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8c4c92cd-5fc8-4148-81cf-54023ec29f3e","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-cf65e4/rate-test-model-cf65e4\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-cf65e4/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T12:49:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8c4c92cd-5fc8-4148-81cf-54023ec29f3e","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-16T12:49:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8c4c92cd-5fc8-4148-81cf-54023ec29f3e","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-a8af01"}
{"level":"debug","ts":"2026-07-16T12:49:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8c4c92cd-5fc8-4148-81cf-54023ec29f3e","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-16T12:49:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8c4c92cd-5fc8-4148-81cf-54023ec29f3e","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"cb4a12d1-3756-4797-87d8-a6e82a27c43c","keyName":"e2e-rate-a-a8af01","selected_subscription":"e2e-rate-iso-a-a8af01","selected_subscription_key":"ai-tenant-e2e-shared-a-cf65e4/e2e-rate-iso-a-a8af01@ai-tenant-e2e-shared-a-cf65e4/rate-test-model-cf65e4","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-cf65e4","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-a8af01","namespace":"ai-tenant-e2e-shared-a-cf65e4","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-16T12:49:33Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8c4c92cd-5fc8-4148-81cf-54023ec29f3e","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-16T12:49:33Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8c4c92cd-5fc8-4148-81cf-54023ec29f3e","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-16T12:49:33Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b9813f1f-e761-4106-b469-27246a476b87","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.9:55860","PortSpecifier":{"PortValue":55860}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.46:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"b9813f1f-e761-4106-b469-27246a476b87","method":"POST","path":"/ai-tenant-e2e-shared-b-3c72a3/rate-test-model-3c72a3/v1/completions","host":"e2e-shared-b-3c72a3.apps.56e63957-e366-4fa5-9a39-a0acea4d0b67.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-16T12:49:33Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"b9813f1f-e761-4106-b469-27246a476b87","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.9:55860","PortSpecifier":{"PortValue":55860}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.46:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784206173,"nanos":147199578},"http":{"id":"b9813f1f-e761-4106-b469-27246a476b87","method":"POST","headers":{":authority":"e2e-shared-b-3c72a3.apps.56e63957-e366-4fa5-9a39-a0acea4d0b67.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-b-3c72a3/rate-test-model-3c72a3/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-16T12:49:33Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"b9813f1f-e761-4106-b469-27246a476b87","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-15h0ywvOrK4NIbMU3_iYM11t6K75zAzHHLvI3dXFkx2qYZEmKuk5fR7iv0szJ"}
{"level":"debug","ts":"2026-07-16T12:49:33Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"b9813f1f-e761-4106-b469-27246a476b87","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-b-3c72a3.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-15h0ywvOrK4NIbMU3_iYM11t6K75zAzHHLvI3dXFkx2qYZEmKuk5fR7iv0szJ\"}"}
{"level":"debug","ts":"2026-07-16T12:49:33Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"b9813f1f-e761-4106-b469-27246a476b87","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-3c72a3.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"d33db670-bc4c-44e3-8002-4c6d77f9f2c4","keyName":"e2e-rate-b-a8af01","subscription":"e2e-rate-iso-b-a8af01","tenant":"e2e-shared-b-3c72a3","userId":"d33db670-bc4c-44e3-8002-4c6d77f9f2c4","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-16T12:49:33Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"b9813f1f-e761-4106-b469-27246a476b87","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-b-3c72a3.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-b-3c72a3/rate-test-model-3c72a3\",\"requestedSubscription\":\"e2e-rate-iso-b-a8af01\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-16T12:49:33Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"b9813f1f-e761-4106-b469-27246a476b87","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-3c72a3.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-3c72a3","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-a8af01","namespace":"ai-tenant-e2e-shared-b-3c72a3","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-16T12:49:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"b9813f1f-e761-4106-b469-27246a476b87","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-16T12:49:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b9813f1f-e761-4106-b469-27246a476b87","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T12:49:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b9813f1f-e761-4106-b469-27246a476b87","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T12:49:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b9813f1f-e761-4106-b469-27246a476b87","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-3c72a3/rate-test-model-3c72a3\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-3c72a3/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T12:49:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b9813f1f-e761-4106-b469-27246a476b87","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-16T12:49:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b9813f1f-e761-4106-b469-27246a476b87","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-16T12:49:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b9813f1f-e761-4106-b469-27246a476b87","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-b-a8af01"}
{"level":"debug","ts":"2026-07-16T12:49:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b9813f1f-e761-4106-b469-27246a476b87","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-16T12:49:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b9813f1f-e761-4106-b469-27246a476b87","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"d33db670-bc4c-44e3-8002-4c6d77f9f2c4","keyName":"e2e-rate-b-a8af01","selected_subscription":"e2e-rate-iso-b-a8af01","selected_subscription_key":"ai-tenant-e2e-shared-b-3c72a3/e2e-rate-iso-b-a8af01@ai-tenant-e2e-shared-b-3c72a3/rate-test-model-3c72a3","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-3c72a3","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-a8af01","namespace":"ai-tenant-e2e-shared-b-3c72a3","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-16T12:49:33Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b9813f1f-e761-4106-b469-27246a476b87","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-16T12:49:33Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b9813f1f-e761-4106-b469-27246a476b87","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-16T12:49:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/53f52ac211c8624c51dfa5bce1cd198ac858897010a06d01cdc91e9c4021bc0d"}
{"level":"info","ts":"2026-07-16T12:49:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/539ee5d381d39f5b109334ff859978b7dac83b83797b5412feeda7913eabc368"}
{"level":"info","ts":"2026-07-16T12:49:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/33376ded201330b067375ef58939cf59c7221be5542cd4f5cc833c69a603072a"}
{"level":"info","ts":"2026-07-16T12:49:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/8ec9317f0f606341ce1891699b03e177dc2d7cfea9b5699eb2793678ce671bf7"}
{"level":"info","ts":"2026-07-16T12:49:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/6c93892968c73bc36dbfe8b63123dee8f78db93b2eb2f459f81fa3d667c2b475"}
{"level":"info","ts":"2026-07-16T12:49:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/80779c0eda5cd7a6e233973bb318aae6ef71c0b5bc5b9deefb7d01febf322912"}
{"level":"info","ts":"2026-07-16T12:49:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/d9594d0e39509d52e5e1c59948d2450f9d484dc99e9af0473da61480df1604f4"}
{"level":"info","ts":"2026-07-16T12:49:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/8859358d9c70fa785b76b922f9c9f52c19a57d1a0245f638ee0c7133fe0c4835"}
{"level":"info","ts":"2026-07-16T12:49:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/c94fb88468b9960d43084002a3472612c8de78df6a69c1c68ab3924e268f057c"}
{"level":"info","ts":"2026-07-16T12:49:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/b52a5b6af490156bb5395fa475699bf4747c3462252b5cf8b2a40a4c08b2aeb5"}
{"level":"info","ts":"2026-07-16T12:49:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/b7b1db4c1f47dd4c9ca7344bf9dc87bf7d16caed6648a287dde9311377083656"}
{"level":"info","ts":"2026-07-16T12:49:42Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/6c176e1d29eb1b98bdf75b779ac2a5558dcac4100d09c23719c15c54c408157e"}
{"level":"info","ts":"2026-07-16T12:49:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/3d03cf5abc8d8f28225f429b9dec31611f300ea9a3db88049da8697f486e394f"}
{"level":"info","ts":"2026-07-16T12:49:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/c2a728907b467a9bce69d99584fd98b4e173fb6fb4efa879297ab7b77d572ce1"}
{"level":"info","ts":"2026-07-16T12:49:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/a24d47fc1afffc9a1d034ea31929737ac4543a2bf6b21a2e5ef58aada8655782"}
{"level":"info","ts":"2026-07-16T12:49:43Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/884ca9ffd2dbe65a21e331996613c657d934e310ec870f9e66cd9a1e50002870"}
{"level":"info","ts":"2026-07-16T12:50:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/5fcf87ed71a7efdcf6c0979c69c1fe9d9d644200c306a3be69a6d2799103ea5e"}
{"level":"info","ts":"2026-07-16T12:50:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/915574f2841bb917969288337fffc33b8a863442d74775ad9158917d217f4ad3"}
{"level":"info","ts":"2026-07-16T12:50:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/a9cad8e0d62ad889770ce0987e3a9baf289b961453fc6d5aae7115070f279aad"}
{"level":"info","ts":"2026-07-16T12:50:06Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/c8e972911172fba6c0bc721dce3f71eb71e77fb6eee2f3302c2f7e46f6e7f332"}
{"level":"info","ts":"2026-07-16T12:50:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/eeda2e141870831cd50afa2f290bee9f781b7011cf782d58ef96abcdf9109604"}
{"level":"info","ts":"2026-07-16T12:50:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/a634a89b78d294b9fc49d017e32bcefe6e2852203693c067a5d46766f97b14f9"}
{"level":"info","ts":"2026-07-16T12:50:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/ab4383e39fe7dadf6a026f479b3b243d33b87183871c28faa180378e18c3a176"}
{"level":"info","ts":"2026-07-16T12:50:12Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/6228ba29aa9b6a37d040e651a7775fd984f96fcf3dbd4414f468eb4785c49e3e"}