{"level":"info","ts":"2026-07-22T02:28:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ab15274616586b718376ae73e81534777714f2b93e19d8b3e074ed577dee096f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T02:28:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"017bef8ad369aedf4693a42b618314a1f78b40210183a1a3e12c6c4db526667e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T02:28:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d4f746357f835389e04bd5a96522f198f7d47065d83d9523850f6afdcd8db8b3","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T02:28:33Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T02:28:33Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["d4f746357f835389e04bd5a96522f198f7d47065d83d9523850f6afdcd8db8b3"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T02:28:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d4f746357f835389e04bd5a96522f198f7d47065d83d9523850f6afdcd8db8b3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T02:28:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7e05aa5b212f5a5228cfb7fc933b146391673a6a8a35766c7a79ed7a54262847","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-22T02:28:33Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-22T02:28:33Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T02:28:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7e05aa5b212f5a5228cfb7fc933b146391673a6a8a35766c7a79ed7a54262847"}
{"level":"info","ts":"2026-07-22T02:28:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7e05aa5b212f5a5228cfb7fc933b146391673a6a8a35766c7a79ed7a54262847","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T02:28:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ab15274616586b718376ae73e81534777714f2b93e19d8b3e074ed577dee096f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-22T02:28:33Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-22T02:28:33Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T02:28:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ab15274616586b718376ae73e81534777714f2b93e19d8b3e074ed577dee096f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T02:28:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d4f746357f835389e04bd5a96522f198f7d47065d83d9523850f6afdcd8db8b3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T02:28:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5481d28448c620ebc6126ed4ad453403cdf551a9ca98012f0c48af3efabdeaa6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-22T02:28:33Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-22T02:28:33Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T02:28:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ab15274616586b718376ae73e81534777714f2b93e19d8b3e074ed577dee096f"}
{"level":"info","ts":"2026-07-22T02:28:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5481d28448c620ebc6126ed4ad453403cdf551a9ca98012f0c48af3efabdeaa6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T02:28:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7e05aa5b212f5a5228cfb7fc933b146391673a6a8a35766c7a79ed7a54262847","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T02:28:33Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T02:28:33Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["7e05aa5b212f5a5228cfb7fc933b146391673a6a8a35766c7a79ed7a54262847"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T02:28:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/017bef8ad369aedf4693a42b618314a1f78b40210183a1a3e12c6c4db526667e"}
{"level":"info","ts":"2026-07-22T02:28:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7e05aa5b212f5a5228cfb7fc933b146391673a6a8a35766c7a79ed7a54262847","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T02:28:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ab15274616586b718376ae73e81534777714f2b93e19d8b3e074ed577dee096f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T02:28:33Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T02:28:33Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["ab15274616586b718376ae73e81534777714f2b93e19d8b3e074ed577dee096f"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T02:28:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ab15274616586b718376ae73e81534777714f2b93e19d8b3e074ed577dee096f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T02:28:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5fdbf5479088293464dd4dabcef1ab9234e359edec1f2e22b5addffea335a85f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-22T02:28:33Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-22T02:28:33Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T02:28:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d4f746357f835389e04bd5a96522f198f7d47065d83d9523850f6afdcd8db8b3"}
{"level":"info","ts":"2026-07-22T02:28:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5fdbf5479088293464dd4dabcef1ab9234e359edec1f2e22b5addffea335a85f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T02:28:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5481d28448c620ebc6126ed4ad453403cdf551a9ca98012f0c48af3efabdeaa6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-22T02:28:33Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-22T02:28:33Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T02:28:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5481d28448c620ebc6126ed4ad453403cdf551a9ca98012f0c48af3efabdeaa6"}
{"level":"info","ts":"2026-07-22T02:28:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5481d28448c620ebc6126ed4ad453403cdf551a9ca98012f0c48af3efabdeaa6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T02:28:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7e05aa5b212f5a5228cfb7fc933b146391673a6a8a35766c7a79ed7a54262847","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-22T02:28:33Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-22T02:28:33Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T02:28:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7e05aa5b212f5a5228cfb7fc933b146391673a6a8a35766c7a79ed7a54262847","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T02:28:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ab15274616586b718376ae73e81534777714f2b93e19d8b3e074ed577dee096f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T02:28:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5fdbf5479088293464dd4dabcef1ab9234e359edec1f2e22b5addffea335a85f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T02:28:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5481d28448c620ebc6126ed4ad453403cdf551a9ca98012f0c48af3efabdeaa6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T02:28:33Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T02:28:33Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["5481d28448c620ebc6126ed4ad453403cdf551a9ca98012f0c48af3efabdeaa6"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T02:28:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7e05aa5b212f5a5228cfb7fc933b146391673a6a8a35766c7a79ed7a54262847"}
{"level":"info","ts":"2026-07-22T02:28:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5481d28448c620ebc6126ed4ad453403cdf551a9ca98012f0c48af3efabdeaa6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T02:28:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7e05aa5b212f5a5228cfb7fc933b146391673a6a8a35766c7a79ed7a54262847","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T02:28:33Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T02:28:33Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["7e05aa5b212f5a5228cfb7fc933b146391673a6a8a35766c7a79ed7a54262847"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T02:28:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ab15274616586b718376ae73e81534777714f2b93e19d8b3e074ed577dee096f"}
{"level":"info","ts":"2026-07-22T02:28:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7e05aa5b212f5a5228cfb7fc933b146391673a6a8a35766c7a79ed7a54262847","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T02:28:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5fdbf5479088293464dd4dabcef1ab9234e359edec1f2e22b5addffea335a85f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-22T02:28:33Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-22T02:28:33Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T02:28:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5fdbf5479088293464dd4dabcef1ab9234e359edec1f2e22b5addffea335a85f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T02:28:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5481d28448c620ebc6126ed4ad453403cdf551a9ca98012f0c48af3efabdeaa6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T02:28:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7e05aa5b212f5a5228cfb7fc933b146391673a6a8a35766c7a79ed7a54262847","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T02:28:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5fdbf5479088293464dd4dabcef1ab9234e359edec1f2e22b5addffea335a85f","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-22T02:28:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5fdbf5479088293464dd4dabcef1ab9234e359edec1f2e22b5addffea335a85f"}
{"level":"debug","ts":"2026-07-22T02:28:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5fdbf5479088293464dd4dabcef1ab9234e359edec1f2e22b5addffea335a85f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T02:28:33Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T02:28:33Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["5fdbf5479088293464dd4dabcef1ab9234e359edec1f2e22b5addffea335a85f"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T02:28:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5481d28448c620ebc6126ed4ad453403cdf551a9ca98012f0c48af3efabdeaa6"}
{"level":"info","ts":"2026-07-22T02:28:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5fdbf5479088293464dd4dabcef1ab9234e359edec1f2e22b5addffea335a85f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T02:28:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5fdbf5479088293464dd4dabcef1ab9234e359edec1f2e22b5addffea335a85f","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-22T02:28:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7e05aa5b212f5a5228cfb7fc933b146391673a6a8a35766c7a79ed7a54262847"}
{"level":"info","ts":"2026-07-22T02:28:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5fdbf5479088293464dd4dabcef1ab9234e359edec1f2e22b5addffea335a85f"}
{"level":"debug","ts":"2026-07-22T02:28:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1052ea21b2bde5c25b38961de7418c5ec82a5472cef64ce758524569d5140f77","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-22T02:28:33Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-22T02:28:33Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T02:28:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1052ea21b2bde5c25b38961de7418c5ec82a5472cef64ce758524569d5140f77","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T02:28:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1052ea21b2bde5c25b38961de7418c5ec82a5472cef64ce758524569d5140f77","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-22T02:28:33Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-22T02:28:33Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T02:28:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1052ea21b2bde5c25b38961de7418c5ec82a5472cef64ce758524569d5140f77"}
{"level":"info","ts":"2026-07-22T02:28:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1052ea21b2bde5c25b38961de7418c5ec82a5472cef64ce758524569d5140f77","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T02:28:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1052ea21b2bde5c25b38961de7418c5ec82a5472cef64ce758524569d5140f77","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-22T02:28:33Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-22T02:28:33Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"error","ts":"2026-07-22T02:28:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"1052ea21b2bde5c25b38961de7418c5ec82a5472cef64ce758524569d5140f77","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"1052ea21b2bde5c25b38961de7418c5ec82a5472cef64ce758524569d5140f77\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-22T02:28:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1052ea21b2bde5c25b38961de7418c5ec82a5472cef64ce758524569d5140f77","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T02:28:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1052ea21b2bde5c25b38961de7418c5ec82a5472cef64ce758524569d5140f77","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-22T02:28:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1052ea21b2bde5c25b38961de7418c5ec82a5472cef64ce758524569d5140f77"}
{"level":"info","ts":"2026-07-22T02:28:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1052ea21b2bde5c25b38961de7418c5ec82a5472cef64ce758524569d5140f77"}
{"level":"debug","ts":"2026-07-22T02:28:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0106e4f1216de4e8b2e96af0848f40cfa078e4a51b2808215072722924399f8a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-22T02:28:33Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-22T02:28:33Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T02:28:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0106e4f1216de4e8b2e96af0848f40cfa078e4a51b2808215072722924399f8a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T02:28:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1052ea21b2bde5c25b38961de7418c5ec82a5472cef64ce758524569d5140f77","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T02:28:33Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T02:28:33Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["1052ea21b2bde5c25b38961de7418c5ec82a5472cef64ce758524569d5140f77"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T02:28:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0106e4f1216de4e8b2e96af0848f40cfa078e4a51b2808215072722924399f8a"}
{"level":"info","ts":"2026-07-22T02:28:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1052ea21b2bde5c25b38961de7418c5ec82a5472cef64ce758524569d5140f77","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T02:28:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0106e4f1216de4e8b2e96af0848f40cfa078e4a51b2808215072722924399f8a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T02:28:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1052ea21b2bde5c25b38961de7418c5ec82a5472cef64ce758524569d5140f77","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T02:28:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0106e4f1216de4e8b2e96af0848f40cfa078e4a51b2808215072722924399f8a","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-22T02:28:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0106e4f1216de4e8b2e96af0848f40cfa078e4a51b2808215072722924399f8a"}
{"level":"debug","ts":"2026-07-22T02:28:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0106e4f1216de4e8b2e96af0848f40cfa078e4a51b2808215072722924399f8a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T02:28:33Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T02:28:33Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["0106e4f1216de4e8b2e96af0848f40cfa078e4a51b2808215072722924399f8a"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T02:28:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1052ea21b2bde5c25b38961de7418c5ec82a5472cef64ce758524569d5140f77"}
{"level":"info","ts":"2026-07-22T02:28:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0106e4f1216de4e8b2e96af0848f40cfa078e4a51b2808215072722924399f8a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T02:28:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0106e4f1216de4e8b2e96af0848f40cfa078e4a51b2808215072722924399f8a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-22T02:28:33Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-22T02:28:33Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T02:28:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0106e4f1216de4e8b2e96af0848f40cfa078e4a51b2808215072722924399f8a"}
{"level":"info","ts":"2026-07-22T02:28:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0106e4f1216de4e8b2e96af0848f40cfa078e4a51b2808215072722924399f8a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T02:28:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0106e4f1216de4e8b2e96af0848f40cfa078e4a51b2808215072722924399f8a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T02:28:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0106e4f1216de4e8b2e96af0848f40cfa078e4a51b2808215072722924399f8a","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-22T02:28:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0106e4f1216de4e8b2e96af0848f40cfa078e4a51b2808215072722924399f8a"}
{"level":"debug","ts":"2026-07-22T02:28:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0106e4f1216de4e8b2e96af0848f40cfa078e4a51b2808215072722924399f8a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T02:28:33Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T02:28:33Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["0106e4f1216de4e8b2e96af0848f40cfa078e4a51b2808215072722924399f8a"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T02:28:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0106e4f1216de4e8b2e96af0848f40cfa078e4a51b2808215072722924399f8a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T02:28:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0106e4f1216de4e8b2e96af0848f40cfa078e4a51b2808215072722924399f8a","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-22T02:28:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0106e4f1216de4e8b2e96af0848f40cfa078e4a51b2808215072722924399f8a"}
{"level":"debug","ts":"2026-07-22T02:28:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6b0101f48d3950398a9ba432fbcdb8431bb1c98f78ee0c22f78c64e646bdd664","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-22T02:28:33Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-22T02:28:33Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T02:28:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6b0101f48d3950398a9ba432fbcdb8431bb1c98f78ee0c22f78c64e646bdd664"}
{"level":"info","ts":"2026-07-22T02:28:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6b0101f48d3950398a9ba432fbcdb8431bb1c98f78ee0c22f78c64e646bdd664","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T02:28:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c34bed99faca4ccf093c04d0bd2d92f45d470b0daf4cae1f07e7136557c40a09","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-22T02:28:33Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-22T02:28:33Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T02:28:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c34bed99faca4ccf093c04d0bd2d92f45d470b0daf4cae1f07e7136557c40a09"}
{"level":"info","ts":"2026-07-22T02:28:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c34bed99faca4ccf093c04d0bd2d92f45d470b0daf4cae1f07e7136557c40a09","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T02:28:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6b0101f48d3950398a9ba432fbcdb8431bb1c98f78ee0c22f78c64e646bdd664","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T02:28:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c34bed99faca4ccf093c04d0bd2d92f45d470b0daf4cae1f07e7136557c40a09","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T02:28:33Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T02:28:33Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["c34bed99faca4ccf093c04d0bd2d92f45d470b0daf4cae1f07e7136557c40a09"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T02:28:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6b0101f48d3950398a9ba432fbcdb8431bb1c98f78ee0c22f78c64e646bdd664"}
{"level":"info","ts":"2026-07-22T02:28:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c34bed99faca4ccf093c04d0bd2d92f45d470b0daf4cae1f07e7136557c40a09","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T02:28:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6b0101f48d3950398a9ba432fbcdb8431bb1c98f78ee0c22f78c64e646bdd664","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T02:28:33Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T02:28:33Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["6b0101f48d3950398a9ba432fbcdb8431bb1c98f78ee0c22f78c64e646bdd664"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T02:28:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c34bed99faca4ccf093c04d0bd2d92f45d470b0daf4cae1f07e7136557c40a09"}
{"level":"info","ts":"2026-07-22T02:28:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6b0101f48d3950398a9ba432fbcdb8431bb1c98f78ee0c22f78c64e646bdd664","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T02:28:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c34bed99faca4ccf093c04d0bd2d92f45d470b0daf4cae1f07e7136557c40a09","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-22T02:28:33Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-22T02:28:33Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T02:28:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c34bed99faca4ccf093c04d0bd2d92f45d470b0daf4cae1f07e7136557c40a09"}
{"level":"info","ts":"2026-07-22T02:28:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c34bed99faca4ccf093c04d0bd2d92f45d470b0daf4cae1f07e7136557c40a09","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T02:28:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6b0101f48d3950398a9ba432fbcdb8431bb1c98f78ee0c22f78c64e646bdd664","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-22T02:28:33Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-22T02:28:33Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T02:28:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6b0101f48d3950398a9ba432fbcdb8431bb1c98f78ee0c22f78c64e646bdd664"}
{"level":"info","ts":"2026-07-22T02:28:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6b0101f48d3950398a9ba432fbcdb8431bb1c98f78ee0c22f78c64e646bdd664","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T02:28:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c34bed99faca4ccf093c04d0bd2d92f45d470b0daf4cae1f07e7136557c40a09","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T02:28:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6b0101f48d3950398a9ba432fbcdb8431bb1c98f78ee0c22f78c64e646bdd664","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T02:28:33Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T02:28:33Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["6b0101f48d3950398a9ba432fbcdb8431bb1c98f78ee0c22f78c64e646bdd664"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T02:28:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"6b0101f48d3950398a9ba432fbcdb8431bb1c98f78ee0c22f78c64e646bdd664","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T02:28:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c34bed99faca4ccf093c04d0bd2d92f45d470b0daf4cae1f07e7136557c40a09","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T02:28:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"6b0101f48d3950398a9ba432fbcdb8431bb1c98f78ee0c22f78c64e646bdd664","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T02:28:33Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T02:28:33Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["6b0101f48d3950398a9ba432fbcdb8431bb1c98f78ee0c22f78c64e646bdd664"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"error","ts":"2026-07-22T02:28:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"6b0101f48d3950398a9ba432fbcdb8431bb1c98f78ee0c22f78c64e646bdd664","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"6b0101f48d3950398a9ba432fbcdb8431bb1c98f78ee0c22f78c64e646bdd664\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-22T02:28:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6b0101f48d3950398a9ba432fbcdb8431bb1c98f78ee0c22f78c64e646bdd664","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T02:28:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6b0101f48d3950398a9ba432fbcdb8431bb1c98f78ee0c22f78c64e646bdd664","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-22T02:28:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c34bed99faca4ccf093c04d0bd2d92f45d470b0daf4cae1f07e7136557c40a09"}
{"level":"debug","ts":"2026-07-22T02:28:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c34bed99faca4ccf093c04d0bd2d92f45d470b0daf4cae1f07e7136557c40a09","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T02:28:33Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T02:28:33Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["c34bed99faca4ccf093c04d0bd2d92f45d470b0daf4cae1f07e7136557c40a09"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T02:28:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c34bed99faca4ccf093c04d0bd2d92f45d470b0daf4cae1f07e7136557c40a09","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T02:28:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"47c67cae0f9cf1600d05bf217ab25a874bbafb2d98b28dfc1d5590c9e9683772","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-22T02:28:33Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-22T02:28:33Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T02:28:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"47c67cae0f9cf1600d05bf217ab25a874bbafb2d98b28dfc1d5590c9e9683772","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T02:28:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c34bed99faca4ccf093c04d0bd2d92f45d470b0daf4cae1f07e7136557c40a09","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T02:28:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1be94ebf031df9476f3ed66e20d33d184b3ebd42a5b54d97f0677924ed736f47","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-22T02:28:33Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-22T02:28:33Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T02:28:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6b0101f48d3950398a9ba432fbcdb8431bb1c98f78ee0c22f78c64e646bdd664"}
{"level":"info","ts":"2026-07-22T02:28:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1be94ebf031df9476f3ed66e20d33d184b3ebd42a5b54d97f0677924ed736f47","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T02:28:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"47c67cae0f9cf1600d05bf217ab25a874bbafb2d98b28dfc1d5590c9e9683772","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-22T02:28:33Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-22T02:28:33Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T02:28:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"47c67cae0f9cf1600d05bf217ab25a874bbafb2d98b28dfc1d5590c9e9683772","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T02:28:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1be94ebf031df9476f3ed66e20d33d184b3ebd42a5b54d97f0677924ed736f47","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T02:28:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"47c67cae0f9cf1600d05bf217ab25a874bbafb2d98b28dfc1d5590c9e9683772","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-22T02:28:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/47c67cae0f9cf1600d05bf217ab25a874bbafb2d98b28dfc1d5590c9e9683772"}
{"level":"debug","ts":"2026-07-22T02:28:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"47c67cae0f9cf1600d05bf217ab25a874bbafb2d98b28dfc1d5590c9e9683772","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T02:28:34Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T02:28:34Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["47c67cae0f9cf1600d05bf217ab25a874bbafb2d98b28dfc1d5590c9e9683772"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T02:28:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"47c67cae0f9cf1600d05bf217ab25a874bbafb2d98b28dfc1d5590c9e9683772","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T02:28:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1be94ebf031df9476f3ed66e20d33d184b3ebd42a5b54d97f0677924ed736f47","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T02:28:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"47c67cae0f9cf1600d05bf217ab25a874bbafb2d98b28dfc1d5590c9e9683772","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-22T02:28:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c34bed99faca4ccf093c04d0bd2d92f45d470b0daf4cae1f07e7136557c40a09"}
{"level":"debug","ts":"2026-07-22T02:28:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1be94ebf031df9476f3ed66e20d33d184b3ebd42a5b54d97f0677924ed736f47","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-22T02:28:33Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-22T02:28:33Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T02:28:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1be94ebf031df9476f3ed66e20d33d184b3ebd42a5b54d97f0677924ed736f47"}
{"level":"info","ts":"2026-07-22T02:28:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1be94ebf031df9476f3ed66e20d33d184b3ebd42a5b54d97f0677924ed736f47","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T02:28:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a86c535d87f73a7405d50223379da0c4ac8ce54795f786efc0194f29be070ccb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-22T02:28:34Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-22T02:28:34Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T02:28:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/47c67cae0f9cf1600d05bf217ab25a874bbafb2d98b28dfc1d5590c9e9683772"}
{"level":"info","ts":"2026-07-22T02:28:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a86c535d87f73a7405d50223379da0c4ac8ce54795f786efc0194f29be070ccb"}
{"level":"info","ts":"2026-07-22T02:28:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b73d78c2fd1225195efc8a2d5c84696f44b8b29a6d2696ef9f4b80485443f2bb"}
{"level":"info","ts":"2026-07-22T02:28:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a86c535d87f73a7405d50223379da0c4ac8ce54795f786efc0194f29be070ccb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T02:28:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b73d78c2fd1225195efc8a2d5c84696f44b8b29a6d2696ef9f4b80485443f2bb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T02:28:34Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T02:28:34Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["b73d78c2fd1225195efc8a2d5c84696f44b8b29a6d2696ef9f4b80485443f2bb"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T02:28:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1be94ebf031df9476f3ed66e20d33d184b3ebd42a5b54d97f0677924ed736f47"}
{"level":"info","ts":"2026-07-22T02:28:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/24990eeeefe2b26fd1e764edf3e286550b5ad5aaf0d8dd9fdbca10c0d719920d"}
{"level":"info","ts":"2026-07-22T02:28:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b73d78c2fd1225195efc8a2d5c84696f44b8b29a6d2696ef9f4b80485443f2bb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T02:28:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1be94ebf031df9476f3ed66e20d33d184b3ebd42a5b54d97f0677924ed736f47","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T02:28:34Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T02:28:34Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["1be94ebf031df9476f3ed66e20d33d184b3ebd42a5b54d97f0677924ed736f47"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T02:28:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a86c535d87f73a7405d50223379da0c4ac8ce54795f786efc0194f29be070ccb"}
{"level":"info","ts":"2026-07-22T02:28:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f63f911ad20ec8d58908d7286e0c468baa847b130acbd6b55c4950dfd4f2214e"}
{"level":"info","ts":"2026-07-22T02:28:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ca49896b8dd759a3e630eb1010ea616f15e75588a9d2b05671523a8e434df7d1"}
{"level":"info","ts":"2026-07-22T02:28:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1be94ebf031df9476f3ed66e20d33d184b3ebd42a5b54d97f0677924ed736f47","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T02:28:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"24990eeeefe2b26fd1e764edf3e286550b5ad5aaf0d8dd9fdbca10c0d719920d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T02:28:34Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T02:28:34Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["24990eeeefe2b26fd1e764edf3e286550b5ad5aaf0d8dd9fdbca10c0d719920d"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T02:28:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b73d78c2fd1225195efc8a2d5c84696f44b8b29a6d2696ef9f4b80485443f2bb"}
{"level":"info","ts":"2026-07-22T02:28:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3edc01bd2023bb40ffd5a0f803000b23139b11c8fcbd6de50e15105135bb5dfe"}
{"level":"info","ts":"2026-07-22T02:28:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"24990eeeefe2b26fd1e764edf3e286550b5ad5aaf0d8dd9fdbca10c0d719920d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T02:28:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a86c535d87f73a7405d50223379da0c4ac8ce54795f786efc0194f29be070ccb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T02:28:34Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T02:28:34Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a86c535d87f73a7405d50223379da0c4ac8ce54795f786efc0194f29be070ccb"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T02:28:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a6605766b33397fe445fbf5f984eb76a25792129c410c06dedafacd2ba447ec0"}
{"level":"info","ts":"2026-07-22T02:28:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1be94ebf031df9476f3ed66e20d33d184b3ebd42a5b54d97f0677924ed736f47"}
{"level":"info","ts":"2026-07-22T02:28:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/98d1603eab1b1b64f57908cf3ce3206543ba8a79c2670cd063a7e58d4ec62a48"}
{"level":"info","ts":"2026-07-22T02:28:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a86c535d87f73a7405d50223379da0c4ac8ce54795f786efc0194f29be070ccb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T02:28:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f63f911ad20ec8d58908d7286e0c468baa847b130acbd6b55c4950dfd4f2214e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T02:28:34Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T02:28:34Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["f63f911ad20ec8d58908d7286e0c468baa847b130acbd6b55c4950dfd4f2214e"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T02:28:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/24990eeeefe2b26fd1e764edf3e286550b5ad5aaf0d8dd9fdbca10c0d719920d"}
{"level":"info","ts":"2026-07-22T02:28:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/bf65927c2e995159661cb4d48d34217d059b3a0970b47ab32b70396223719355"}
{"level":"info","ts":"2026-07-22T02:28:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f63f911ad20ec8d58908d7286e0c468baa847b130acbd6b55c4950dfd4f2214e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T02:28:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ca49896b8dd759a3e630eb1010ea616f15e75588a9d2b05671523a8e434df7d1","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T02:28:34Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T02:28:34Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["ca49896b8dd759a3e630eb1010ea616f15e75588a9d2b05671523a8e434df7d1"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T02:28:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a87347e676159f925f532d091c7af7a4f62ac5d1e01cd2f5a192984a4ac74858"}
{"level":"info","ts":"2026-07-22T02:28:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8155cead5addae80c60ae80fda2fe6e7762360a66b946b9f96b8a6aeb142a752"}
{"level":"info","ts":"2026-07-22T02:28:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ca49896b8dd759a3e630eb1010ea616f15e75588a9d2b05671523a8e434df7d1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T02:28:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b73d78c2fd1225195efc8a2d5c84696f44b8b29a6d2696ef9f4b80485443f2bb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T02:28:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"3edc01bd2023bb40ffd5a0f803000b23139b11c8fcbd6de50e15105135bb5dfe","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T02:28:34Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T02:28:34Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["3edc01bd2023bb40ffd5a0f803000b23139b11c8fcbd6de50e15105135bb5dfe"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T02:28:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a86c535d87f73a7405d50223379da0c4ac8ce54795f786efc0194f29be070ccb"}
{"level":"info","ts":"2026-07-22T02:28:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f63f911ad20ec8d58908d7286e0c468baa847b130acbd6b55c4950dfd4f2214e"}
{"level":"info","ts":"2026-07-22T02:28:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ca49896b8dd759a3e630eb1010ea616f15e75588a9d2b05671523a8e434df7d1"}
{"level":"info","ts":"2026-07-22T02:28:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"3edc01bd2023bb40ffd5a0f803000b23139b11c8fcbd6de50e15105135bb5dfe","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T02:28:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a6605766b33397fe445fbf5f984eb76a25792129c410c06dedafacd2ba447ec0","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T02:28:34Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T02:28:34Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a6605766b33397fe445fbf5f984eb76a25792129c410c06dedafacd2ba447ec0"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T02:28:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/3edc01bd2023bb40ffd5a0f803000b23139b11c8fcbd6de50e15105135bb5dfe"}
{"level":"info","ts":"2026-07-22T02:28:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a6605766b33397fe445fbf5f984eb76a25792129c410c06dedafacd2ba447ec0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T02:28:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1be94ebf031df9476f3ed66e20d33d184b3ebd42a5b54d97f0677924ed736f47","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T02:28:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"98d1603eab1b1b64f57908cf3ce3206543ba8a79c2670cd063a7e58d4ec62a48","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T02:28:34Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T02:28:34Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["98d1603eab1b1b64f57908cf3ce3206543ba8a79c2670cd063a7e58d4ec62a48"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T02:28:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a6605766b33397fe445fbf5f984eb76a25792129c410c06dedafacd2ba447ec0"}
{"level":"info","ts":"2026-07-22T02:28:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"98d1603eab1b1b64f57908cf3ce3206543ba8a79c2670cd063a7e58d4ec62a48","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T02:28:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"24990eeeefe2b26fd1e764edf3e286550b5ad5aaf0d8dd9fdbca10c0d719920d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T02:28:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"bf65927c2e995159661cb4d48d34217d059b3a0970b47ab32b70396223719355","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T02:28:34Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T02:28:34Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["bf65927c2e995159661cb4d48d34217d059b3a0970b47ab32b70396223719355"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T02:28:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/98d1603eab1b1b64f57908cf3ce3206543ba8a79c2670cd063a7e58d4ec62a48"}
{"level":"info","ts":"2026-07-22T02:28:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"bf65927c2e995159661cb4d48d34217d059b3a0970b47ab32b70396223719355","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T02:28:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a87347e676159f925f532d091c7af7a4f62ac5d1e01cd2f5a192984a4ac74858","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T02:28:34Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T02:28:34Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a87347e676159f925f532d091c7af7a4f62ac5d1e01cd2f5a192984a4ac74858"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T02:28:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/bf65927c2e995159661cb4d48d34217d059b3a0970b47ab32b70396223719355"}
{"level":"info","ts":"2026-07-22T02:28:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a87347e676159f925f532d091c7af7a4f62ac5d1e01cd2f5a192984a4ac74858","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T02:28:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8155cead5addae80c60ae80fda2fe6e7762360a66b946b9f96b8a6aeb142a752","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T02:28:34Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T02:28:34Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["8155cead5addae80c60ae80fda2fe6e7762360a66b946b9f96b8a6aeb142a752"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T02:28:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a87347e676159f925f532d091c7af7a4f62ac5d1e01cd2f5a192984a4ac74858"}
{"level":"info","ts":"2026-07-22T02:28:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8155cead5addae80c60ae80fda2fe6e7762360a66b946b9f96b8a6aeb142a752","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T02:28:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a86c535d87f73a7405d50223379da0c4ac8ce54795f786efc0194f29be070ccb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T02:28:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f63f911ad20ec8d58908d7286e0c468baa847b130acbd6b55c4950dfd4f2214e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T02:28:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ca49896b8dd759a3e630eb1010ea616f15e75588a9d2b05671523a8e434df7d1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T02:28:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"3edc01bd2023bb40ffd5a0f803000b23139b11c8fcbd6de50e15105135bb5dfe","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T02:28:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a6605766b33397fe445fbf5f984eb76a25792129c410c06dedafacd2ba447ec0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T02:28:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"98d1603eab1b1b64f57908cf3ce3206543ba8a79c2670cd063a7e58d4ec62a48","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T02:28:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"bf65927c2e995159661cb4d48d34217d059b3a0970b47ab32b70396223719355","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T02:28:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a87347e676159f925f532d091c7af7a4f62ac5d1e01cd2f5a192984a4ac74858","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T02:28:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8155cead5addae80c60ae80fda2fe6e7762360a66b946b9f96b8a6aeb142a752","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-22T02:28:34Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-22T02:28:34Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T02:28:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8155cead5addae80c60ae80fda2fe6e7762360a66b946b9f96b8a6aeb142a752"}
{"level":"info","ts":"2026-07-22T02:28:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8155cead5addae80c60ae80fda2fe6e7762360a66b946b9f96b8a6aeb142a752","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T02:28:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8155cead5addae80c60ae80fda2fe6e7762360a66b946b9f96b8a6aeb142a752","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T02:28:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8155cead5addae80c60ae80fda2fe6e7762360a66b946b9f96b8a6aeb142a752","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-22T02:28:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8155cead5addae80c60ae80fda2fe6e7762360a66b946b9f96b8a6aeb142a752"}
{"level":"debug","ts":"2026-07-22T02:28:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8155cead5addae80c60ae80fda2fe6e7762360a66b946b9f96b8a6aeb142a752","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T02:28:34Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T02:28:34Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["8155cead5addae80c60ae80fda2fe6e7762360a66b946b9f96b8a6aeb142a752"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T02:28:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8155cead5addae80c60ae80fda2fe6e7762360a66b946b9f96b8a6aeb142a752","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T02:28:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8155cead5addae80c60ae80fda2fe6e7762360a66b946b9f96b8a6aeb142a752","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-22T02:28:34Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-22T02:28:34Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T02:28:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8155cead5addae80c60ae80fda2fe6e7762360a66b946b9f96b8a6aeb142a752"}
{"level":"info","ts":"2026-07-22T02:28:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8155cead5addae80c60ae80fda2fe6e7762360a66b946b9f96b8a6aeb142a752","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T02:28:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8155cead5addae80c60ae80fda2fe6e7762360a66b946b9f96b8a6aeb142a752","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T02:28:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8155cead5addae80c60ae80fda2fe6e7762360a66b946b9f96b8a6aeb142a752","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-22T02:28:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8155cead5addae80c60ae80fda2fe6e7762360a66b946b9f96b8a6aeb142a752"}
{"level":"debug","ts":"2026-07-22T02:28:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8155cead5addae80c60ae80fda2fe6e7762360a66b946b9f96b8a6aeb142a752","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-22T02:28:34Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-22T02:28:34Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["8155cead5addae80c60ae80fda2fe6e7762360a66b946b9f96b8a6aeb142a752"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-22T02:28:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8155cead5addae80c60ae80fda2fe6e7762360a66b946b9f96b8a6aeb142a752","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-22T02:28:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8155cead5addae80c60ae80fda2fe6e7762360a66b946b9f96b8a6aeb142a752","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-22T02:28:34Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8155cead5addae80c60ae80fda2fe6e7762360a66b946b9f96b8a6aeb142a752"}
{"level":"info","ts":"2026-07-22T02:28:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"cf41d336-7697-4552-b1fb-e08c929b5971","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.14:34258","PortSpecifier":{"PortValue":34258}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"cf41d336-7697-4552-b1fb-e08c929b5971","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-000830.apps.baac7630-667b-48fb-8c97-fe8ebd588071.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-22T02:28:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"cf41d336-7697-4552-b1fb-e08c929b5971","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.14:34258","PortSpecifier":{"PortValue":34258}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784687319,"nanos":516933883},"http":{"id":"cf41d336-7697-4552-b1fb-e08c929b5971","method":"POST","headers":{":authority":"e2e-shared-a-000830.apps.baac7630-667b-48fb-8c97-fe8ebd588071.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T02:28:39Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"cf41d336-7697-4552-b1fb-e08c929b5971","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-22T02:28:39Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"cf41d336-7697-4552-b1fb-e08c929b5971","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"ea87c7df-7d44-4a6d-a086-2850f9733702","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=d0ea8cc2-7b86-4b0b-bbc0-db31674de9e3"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/fe8ebd588071"]}}
{"level":"debug","ts":"2026-07-22T02:28:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"cf41d336-7697-4552-b1fb-e08c929b5971","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/fe8ebd588071"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=d0ea8cc2-7b86-4b0b-bbc0-db31674de9e3"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"ea87c7df-7d44-4a6d-a086-2850f9733702","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"a6605766b33397fe445fbf5f984eb76a25792129c410c06dedafacd2ba447ec0"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.54:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-000830.apps.baac7630-667b-48fb-8c97-fe8ebd588071.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T02:28:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cf41d336-7697-4552-b1fb-e08c929b5971","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T02:28:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cf41d336-7697-4552-b1fb-e08c929b5971","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T02:28:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cf41d336-7697-4552-b1fb-e08c929b5971","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-000830/rate-test-model-000830\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-000830/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T02:28:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"cf41d336-7697-4552-b1fb-e08c929b5971","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-22T02:28:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cf41d336-7697-4552-b1fb-e08c929b5971","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-22T02:28:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cf41d336-7697-4552-b1fb-e08c929b5971","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-22T02:28:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"cf41d336-7697-4552-b1fb-e08c929b5971","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-22T02:28:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"cf41d336-7697-4552-b1fb-e08c929b5971","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-22T02:28:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"903db0cf-fe7d-4142-b96f-62158ead80d7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.14:49958","PortSpecifier":{"PortValue":49958}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"903db0cf-fe7d-4142-b96f-62158ead80d7","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-7eead4.apps.baac7630-667b-48fb-8c97-fe8ebd588071.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-22T02:28:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"903db0cf-fe7d-4142-b96f-62158ead80d7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.14:49958","PortSpecifier":{"PortValue":49958}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784687319,"nanos":562665383},"http":{"id":"903db0cf-fe7d-4142-b96f-62158ead80d7","method":"POST","headers":{":authority":"e2e-shared-b-7eead4.apps.baac7630-667b-48fb-8c97-fe8ebd588071.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T02:28:39Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"903db0cf-fe7d-4142-b96f-62158ead80d7","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-22T02:28:39Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"903db0cf-fe7d-4142-b96f-62158ead80d7","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"ea87c7df-7d44-4a6d-a086-2850f9733702","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=d0ea8cc2-7b86-4b0b-bbc0-db31674de9e3"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/fe8ebd588071"]}}
{"level":"debug","ts":"2026-07-22T02:28:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"903db0cf-fe7d-4142-b96f-62158ead80d7","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/fe8ebd588071"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=d0ea8cc2-7b86-4b0b-bbc0-db31674de9e3"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"ea87c7df-7d44-4a6d-a086-2850f9733702","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"98d1603eab1b1b64f57908cf3ce3206543ba8a79c2670cd063a7e58d4ec62a48"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.55:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-7eead4.apps.baac7630-667b-48fb-8c97-fe8ebd588071.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T02:28:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"903db0cf-fe7d-4142-b96f-62158ead80d7","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T02:28:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"903db0cf-fe7d-4142-b96f-62158ead80d7","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T02:28:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"903db0cf-fe7d-4142-b96f-62158ead80d7","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-7eead4/rate-test-model-7eead4\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-7eead4/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T02:28:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"903db0cf-fe7d-4142-b96f-62158ead80d7","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-22T02:28:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"903db0cf-fe7d-4142-b96f-62158ead80d7","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-22T02:28:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"903db0cf-fe7d-4142-b96f-62158ead80d7","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-22T02:28:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"903db0cf-fe7d-4142-b96f-62158ead80d7","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-22T02:28:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"903db0cf-fe7d-4142-b96f-62158ead80d7","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-22T02:28:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5c135636-71d1-42f0-88bc-7a465adf78e2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.14:34262","PortSpecifier":{"PortValue":34262}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"5c135636-71d1-42f0-88bc-7a465adf78e2","method":"POST","path":"/ai-tenant-e2e-shared-a-000830/rate-test-model-000830/v1/completions","host":"e2e-shared-a-000830.apps.baac7630-667b-48fb-8c97-fe8ebd588071.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-22T02:28:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5c135636-71d1-42f0-88bc-7a465adf78e2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.14:34262","PortSpecifier":{"PortValue":34262}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784687319,"nanos":604469254},"http":{"id":"5c135636-71d1-42f0-88bc-7a465adf78e2","method":"POST","headers":{":authority":"e2e-shared-a-000830.apps.baac7630-667b-48fb-8c97-fe8ebd588071.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-000830/rate-test-model-000830/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T02:28:39Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"5c135636-71d1-42f0-88bc-7a465adf78e2","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-ULvgSIylbiP6BvKm_7e69l0NROR3fUvHgQ7najmgiwD60WEWKVqf8Ucz2qkn"}
{"level":"debug","ts":"2026-07-22T02:28:39Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"5c135636-71d1-42f0-88bc-7a465adf78e2","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-000830.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-ULvgSIylbiP6BvKm_7e69l0NROR3fUvHgQ7najmgiwD60WEWKVqf8Ucz2qkn\"}"}
{"level":"debug","ts":"2026-07-22T02:28:39Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"5c135636-71d1-42f0-88bc-7a465adf78e2","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-000830.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"d061b746-2166-43af-b645-8cd3c228a74b","keyName":"e2e-rate-a-9f1aeb","subscription":"e2e-rate-iso-a-9f1aeb","tenant":"e2e-shared-a-000830","userId":"d061b746-2166-43af-b645-8cd3c228a74b","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-22T02:28:39Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"5c135636-71d1-42f0-88bc-7a465adf78e2","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-000830.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-000830/rate-test-model-000830\",\"requestedSubscription\":\"e2e-rate-iso-a-9f1aeb\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-22T02:28:39Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"5c135636-71d1-42f0-88bc-7a465adf78e2","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-000830.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-000830","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-9f1aeb","namespace":"ai-tenant-e2e-shared-a-000830","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-000830/rate-test-model-000830"}}
{"level":"debug","ts":"2026-07-22T02:28:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"5c135636-71d1-42f0-88bc-7a465adf78e2","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T02:28:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5c135636-71d1-42f0-88bc-7a465adf78e2","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T02:28:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5c135636-71d1-42f0-88bc-7a465adf78e2","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T02:28:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5c135636-71d1-42f0-88bc-7a465adf78e2","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T02:28:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5c135636-71d1-42f0-88bc-7a465adf78e2","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-000830/rate-test-model-000830\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-000830/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T02:28:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5c135636-71d1-42f0-88bc-7a465adf78e2","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-22T02:28:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5c135636-71d1-42f0-88bc-7a465adf78e2","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-9f1aeb"}
{"level":"debug","ts":"2026-07-22T02:28:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5c135636-71d1-42f0-88bc-7a465adf78e2","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-22T02:28:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5c135636-71d1-42f0-88bc-7a465adf78e2","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"d061b746-2166-43af-b645-8cd3c228a74b","keyName":"e2e-rate-a-9f1aeb","selected_subscription":"e2e-rate-iso-a-9f1aeb","selected_subscription_key":"ai-tenant-e2e-shared-a-000830/e2e-rate-iso-a-9f1aeb@ai-tenant-e2e-shared-a-000830/rate-test-model-000830","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-000830","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-9f1aeb","namespace":"ai-tenant-e2e-shared-a-000830","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-000830/rate-test-model-000830"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-22T02:28:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5c135636-71d1-42f0-88bc-7a465adf78e2","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-22T02:28:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5c135636-71d1-42f0-88bc-7a465adf78e2","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-22T02:28:40Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1912cbea-e4b3-4c95-aaef-677ae85f76fb","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.14:56894","PortSpecifier":{"PortValue":56894}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"1912cbea-e4b3-4c95-aaef-677ae85f76fb","method":"POST","path":"/ai-tenant-e2e-shared-a-000830/rate-test-model-000830/v1/completions","host":"e2e-shared-a-000830.apps.baac7630-667b-48fb-8c97-fe8ebd588071.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-22T02:28:40Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1912cbea-e4b3-4c95-aaef-677ae85f76fb","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.14:56894","PortSpecifier":{"PortValue":56894}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784687320,"nanos":669886484},"http":{"id":"1912cbea-e4b3-4c95-aaef-677ae85f76fb","method":"POST","headers":{":authority":"e2e-shared-a-000830.apps.baac7630-667b-48fb-8c97-fe8ebd588071.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-000830/rate-test-model-000830/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T02:28:40Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"1912cbea-e4b3-4c95-aaef-677ae85f76fb","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-ULvgSIylbiP6BvKm_7e69l0NROR3fUvHgQ7najmgiwD60WEWKVqf8Ucz2qkn"}
{"level":"debug","ts":"2026-07-22T02:28:40Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"1912cbea-e4b3-4c95-aaef-677ae85f76fb","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-000830.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-ULvgSIylbiP6BvKm_7e69l0NROR3fUvHgQ7najmgiwD60WEWKVqf8Ucz2qkn\"}"}
{"level":"debug","ts":"2026-07-22T02:28:40Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"1912cbea-e4b3-4c95-aaef-677ae85f76fb","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-000830.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"d061b746-2166-43af-b645-8cd3c228a74b","keyName":"e2e-rate-a-9f1aeb","subscription":"e2e-rate-iso-a-9f1aeb","tenant":"e2e-shared-a-000830","userId":"d061b746-2166-43af-b645-8cd3c228a74b","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-22T02:28:40Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"1912cbea-e4b3-4c95-aaef-677ae85f76fb","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-000830.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-000830/rate-test-model-000830\",\"requestedSubscription\":\"e2e-rate-iso-a-9f1aeb\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-22T02:28:40Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"1912cbea-e4b3-4c95-aaef-677ae85f76fb","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-000830.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-000830","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-9f1aeb","namespace":"ai-tenant-e2e-shared-a-000830","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-000830/rate-test-model-000830"}}
{"level":"debug","ts":"2026-07-22T02:28:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"1912cbea-e4b3-4c95-aaef-677ae85f76fb","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T02:28:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1912cbea-e4b3-4c95-aaef-677ae85f76fb","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T02:28:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1912cbea-e4b3-4c95-aaef-677ae85f76fb","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T02:28:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1912cbea-e4b3-4c95-aaef-677ae85f76fb","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T02:28:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1912cbea-e4b3-4c95-aaef-677ae85f76fb","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-000830/rate-test-model-000830\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-000830/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T02:28:40Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1912cbea-e4b3-4c95-aaef-677ae85f76fb","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-22T02:28:40Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1912cbea-e4b3-4c95-aaef-677ae85f76fb","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-22T02:28:40Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1912cbea-e4b3-4c95-aaef-677ae85f76fb","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-9f1aeb"}
{"level":"debug","ts":"2026-07-22T02:28:40Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1912cbea-e4b3-4c95-aaef-677ae85f76fb","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"d061b746-2166-43af-b645-8cd3c228a74b","keyName":"e2e-rate-a-9f1aeb","selected_subscription":"e2e-rate-iso-a-9f1aeb","selected_subscription_key":"ai-tenant-e2e-shared-a-000830/e2e-rate-iso-a-9f1aeb@ai-tenant-e2e-shared-a-000830/rate-test-model-000830","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-000830","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-9f1aeb","namespace":"ai-tenant-e2e-shared-a-000830","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-000830/rate-test-model-000830"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-22T02:28:40Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1912cbea-e4b3-4c95-aaef-677ae85f76fb","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-22T02:28:40Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1912cbea-e4b3-4c95-aaef-677ae85f76fb","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-22T02:28:41Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"66b479d4-8288-4b0e-bb74-3ca17a710481","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.14:56896","PortSpecifier":{"PortValue":56896}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"66b479d4-8288-4b0e-bb74-3ca17a710481","method":"POST","path":"/ai-tenant-e2e-shared-a-000830/rate-test-model-000830/v1/completions","host":"e2e-shared-a-000830.apps.baac7630-667b-48fb-8c97-fe8ebd588071.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-22T02:28:41Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"66b479d4-8288-4b0e-bb74-3ca17a710481","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.14:56896","PortSpecifier":{"PortValue":56896}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784687321,"nanos":709580397},"http":{"id":"66b479d4-8288-4b0e-bb74-3ca17a710481","method":"POST","headers":{":authority":"e2e-shared-a-000830.apps.baac7630-667b-48fb-8c97-fe8ebd588071.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-000830/rate-test-model-000830/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T02:28:41Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"66b479d4-8288-4b0e-bb74-3ca17a710481","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-ULvgSIylbiP6BvKm_7e69l0NROR3fUvHgQ7najmgiwD60WEWKVqf8Ucz2qkn"}
{"level":"debug","ts":"2026-07-22T02:28:41Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"66b479d4-8288-4b0e-bb74-3ca17a710481","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-000830.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-ULvgSIylbiP6BvKm_7e69l0NROR3fUvHgQ7najmgiwD60WEWKVqf8Ucz2qkn\"}"}
{"level":"debug","ts":"2026-07-22T02:28:41Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"66b479d4-8288-4b0e-bb74-3ca17a710481","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-000830.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"d061b746-2166-43af-b645-8cd3c228a74b","keyName":"e2e-rate-a-9f1aeb","subscription":"e2e-rate-iso-a-9f1aeb","tenant":"e2e-shared-a-000830","userId":"d061b746-2166-43af-b645-8cd3c228a74b","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-22T02:28:41Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"66b479d4-8288-4b0e-bb74-3ca17a710481","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-000830.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-000830/rate-test-model-000830\",\"requestedSubscription\":\"e2e-rate-iso-a-9f1aeb\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-22T02:28:41Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"66b479d4-8288-4b0e-bb74-3ca17a710481","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-000830.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-000830","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-9f1aeb","namespace":"ai-tenant-e2e-shared-a-000830","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-000830/rate-test-model-000830"}}
{"level":"debug","ts":"2026-07-22T02:28:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"66b479d4-8288-4b0e-bb74-3ca17a710481","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T02:28:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"66b479d4-8288-4b0e-bb74-3ca17a710481","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T02:28:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"66b479d4-8288-4b0e-bb74-3ca17a710481","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T02:28:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"66b479d4-8288-4b0e-bb74-3ca17a710481","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T02:28:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"66b479d4-8288-4b0e-bb74-3ca17a710481","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-000830/rate-test-model-000830\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-000830/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T02:28:41Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"66b479d4-8288-4b0e-bb74-3ca17a710481","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-22T02:28:41Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"66b479d4-8288-4b0e-bb74-3ca17a710481","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-22T02:28:41Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"66b479d4-8288-4b0e-bb74-3ca17a710481","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-9f1aeb"}
{"level":"debug","ts":"2026-07-22T02:28:41Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"66b479d4-8288-4b0e-bb74-3ca17a710481","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"d061b746-2166-43af-b645-8cd3c228a74b","keyName":"e2e-rate-a-9f1aeb","selected_subscription":"e2e-rate-iso-a-9f1aeb","selected_subscription_key":"ai-tenant-e2e-shared-a-000830/e2e-rate-iso-a-9f1aeb@ai-tenant-e2e-shared-a-000830/rate-test-model-000830","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-000830","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-9f1aeb","namespace":"ai-tenant-e2e-shared-a-000830","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-000830/rate-test-model-000830"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-22T02:28:41Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"66b479d4-8288-4b0e-bb74-3ca17a710481","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-22T02:28:41Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"66b479d4-8288-4b0e-bb74-3ca17a710481","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-22T02:28:42Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3a9d44e4-752e-49ab-86bf-cd3d116d522b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.14:56910","PortSpecifier":{"PortValue":56910}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"3a9d44e4-752e-49ab-86bf-cd3d116d522b","method":"POST","path":"/ai-tenant-e2e-shared-a-000830/rate-test-model-000830/v1/completions","host":"e2e-shared-a-000830.apps.baac7630-667b-48fb-8c97-fe8ebd588071.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-22T02:28:42Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3a9d44e4-752e-49ab-86bf-cd3d116d522b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.14:56910","PortSpecifier":{"PortValue":56910}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784687322,"nanos":743587401},"http":{"id":"3a9d44e4-752e-49ab-86bf-cd3d116d522b","method":"POST","headers":{":authority":"e2e-shared-a-000830.apps.baac7630-667b-48fb-8c97-fe8ebd588071.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-000830/rate-test-model-000830/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T02:28:42Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"3a9d44e4-752e-49ab-86bf-cd3d116d522b","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-ULvgSIylbiP6BvKm_7e69l0NROR3fUvHgQ7najmgiwD60WEWKVqf8Ucz2qkn"}
{"level":"debug","ts":"2026-07-22T02:28:42Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"3a9d44e4-752e-49ab-86bf-cd3d116d522b","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-000830.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-ULvgSIylbiP6BvKm_7e69l0NROR3fUvHgQ7najmgiwD60WEWKVqf8Ucz2qkn\"}"}
{"level":"debug","ts":"2026-07-22T02:28:42Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"3a9d44e4-752e-49ab-86bf-cd3d116d522b","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-000830.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"d061b746-2166-43af-b645-8cd3c228a74b","keyName":"e2e-rate-a-9f1aeb","subscription":"e2e-rate-iso-a-9f1aeb","tenant":"e2e-shared-a-000830","userId":"d061b746-2166-43af-b645-8cd3c228a74b","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-22T02:28:42Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"3a9d44e4-752e-49ab-86bf-cd3d116d522b","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-000830.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-000830/rate-test-model-000830\",\"requestedSubscription\":\"e2e-rate-iso-a-9f1aeb\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-22T02:28:42Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"3a9d44e4-752e-49ab-86bf-cd3d116d522b","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-000830.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-000830","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-9f1aeb","namespace":"ai-tenant-e2e-shared-a-000830","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-000830/rate-test-model-000830"}}
{"level":"debug","ts":"2026-07-22T02:28:42Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"3a9d44e4-752e-49ab-86bf-cd3d116d522b","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T02:28:42Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3a9d44e4-752e-49ab-86bf-cd3d116d522b","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T02:28:42Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3a9d44e4-752e-49ab-86bf-cd3d116d522b","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T02:28:42Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3a9d44e4-752e-49ab-86bf-cd3d116d522b","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-000830/rate-test-model-000830\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-000830/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T02:28:42Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3a9d44e4-752e-49ab-86bf-cd3d116d522b","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T02:28:42Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3a9d44e4-752e-49ab-86bf-cd3d116d522b","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-9f1aeb"}
{"level":"debug","ts":"2026-07-22T02:28:42Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3a9d44e4-752e-49ab-86bf-cd3d116d522b","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-22T02:28:42Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3a9d44e4-752e-49ab-86bf-cd3d116d522b","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-22T02:28:42Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3a9d44e4-752e-49ab-86bf-cd3d116d522b","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"d061b746-2166-43af-b645-8cd3c228a74b","keyName":"e2e-rate-a-9f1aeb","selected_subscription":"e2e-rate-iso-a-9f1aeb","selected_subscription_key":"ai-tenant-e2e-shared-a-000830/e2e-rate-iso-a-9f1aeb@ai-tenant-e2e-shared-a-000830/rate-test-model-000830","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-000830","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-9f1aeb","namespace":"ai-tenant-e2e-shared-a-000830","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-000830/rate-test-model-000830"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-22T02:28:42Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3a9d44e4-752e-49ab-86bf-cd3d116d522b","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-22T02:28:42Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3a9d44e4-752e-49ab-86bf-cd3d116d522b","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-22T02:28:43Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d9f99546-b4eb-4cb1-a885-677403dbaefa","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.14:56918","PortSpecifier":{"PortValue":56918}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"d9f99546-b4eb-4cb1-a885-677403dbaefa","method":"POST","path":"/ai-tenant-e2e-shared-a-000830/rate-test-model-000830/v1/completions","host":"e2e-shared-a-000830.apps.baac7630-667b-48fb-8c97-fe8ebd588071.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-22T02:28:43Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d9f99546-b4eb-4cb1-a885-677403dbaefa","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.14:56918","PortSpecifier":{"PortValue":56918}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784687323,"nanos":782493027},"http":{"id":"d9f99546-b4eb-4cb1-a885-677403dbaefa","method":"POST","headers":{":authority":"e2e-shared-a-000830.apps.baac7630-667b-48fb-8c97-fe8ebd588071.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-000830/rate-test-model-000830/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T02:28:43Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"d9f99546-b4eb-4cb1-a885-677403dbaefa","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-ULvgSIylbiP6BvKm_7e69l0NROR3fUvHgQ7najmgiwD60WEWKVqf8Ucz2qkn"}
{"level":"debug","ts":"2026-07-22T02:28:43Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"d9f99546-b4eb-4cb1-a885-677403dbaefa","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-000830.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-ULvgSIylbiP6BvKm_7e69l0NROR3fUvHgQ7najmgiwD60WEWKVqf8Ucz2qkn\"}"}
{"level":"debug","ts":"2026-07-22T02:28:43Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"d9f99546-b4eb-4cb1-a885-677403dbaefa","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-000830.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"d061b746-2166-43af-b645-8cd3c228a74b","keyName":"e2e-rate-a-9f1aeb","subscription":"e2e-rate-iso-a-9f1aeb","tenant":"e2e-shared-a-000830","userId":"d061b746-2166-43af-b645-8cd3c228a74b","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-22T02:28:43Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"d9f99546-b4eb-4cb1-a885-677403dbaefa","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-000830.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-000830/rate-test-model-000830\",\"requestedSubscription\":\"e2e-rate-iso-a-9f1aeb\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-22T02:28:43Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"d9f99546-b4eb-4cb1-a885-677403dbaefa","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-000830.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-000830","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-9f1aeb","namespace":"ai-tenant-e2e-shared-a-000830","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-000830/rate-test-model-000830"}}
{"level":"debug","ts":"2026-07-22T02:28:43Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"d9f99546-b4eb-4cb1-a885-677403dbaefa","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T02:28:43Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d9f99546-b4eb-4cb1-a885-677403dbaefa","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T02:28:43Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d9f99546-b4eb-4cb1-a885-677403dbaefa","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T02:28:43Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d9f99546-b4eb-4cb1-a885-677403dbaefa","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-000830/rate-test-model-000830\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-000830/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T02:28:43Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d9f99546-b4eb-4cb1-a885-677403dbaefa","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T02:28:43Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d9f99546-b4eb-4cb1-a885-677403dbaefa","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-22T02:28:43Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d9f99546-b4eb-4cb1-a885-677403dbaefa","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-22T02:28:43Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d9f99546-b4eb-4cb1-a885-677403dbaefa","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-9f1aeb"}
{"level":"debug","ts":"2026-07-22T02:28:43Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d9f99546-b4eb-4cb1-a885-677403dbaefa","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"d061b746-2166-43af-b645-8cd3c228a74b","keyName":"e2e-rate-a-9f1aeb","selected_subscription":"e2e-rate-iso-a-9f1aeb","selected_subscription_key":"ai-tenant-e2e-shared-a-000830/e2e-rate-iso-a-9f1aeb@ai-tenant-e2e-shared-a-000830/rate-test-model-000830","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-000830","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-9f1aeb","namespace":"ai-tenant-e2e-shared-a-000830","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-000830/rate-test-model-000830"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-22T02:28:43Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d9f99546-b4eb-4cb1-a885-677403dbaefa","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-22T02:28:43Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d9f99546-b4eb-4cb1-a885-677403dbaefa","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-22T02:28:44Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"30c1e287-d96a-4171-9afd-cc64baf51be6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.14:56924","PortSpecifier":{"PortValue":56924}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"30c1e287-d96a-4171-9afd-cc64baf51be6","method":"POST","path":"/ai-tenant-e2e-shared-a-000830/rate-test-model-000830/v1/completions","host":"e2e-shared-a-000830.apps.baac7630-667b-48fb-8c97-fe8ebd588071.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-22T02:28:44Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"30c1e287-d96a-4171-9afd-cc64baf51be6","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.14:56924","PortSpecifier":{"PortValue":56924}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784687324,"nanos":820704411},"http":{"id":"30c1e287-d96a-4171-9afd-cc64baf51be6","method":"POST","headers":{":authority":"e2e-shared-a-000830.apps.baac7630-667b-48fb-8c97-fe8ebd588071.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-000830/rate-test-model-000830/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T02:28:44Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"30c1e287-d96a-4171-9afd-cc64baf51be6","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-ULvgSIylbiP6BvKm_7e69l0NROR3fUvHgQ7najmgiwD60WEWKVqf8Ucz2qkn"}
{"level":"debug","ts":"2026-07-22T02:28:44Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"30c1e287-d96a-4171-9afd-cc64baf51be6","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-000830.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-ULvgSIylbiP6BvKm_7e69l0NROR3fUvHgQ7najmgiwD60WEWKVqf8Ucz2qkn\"}"}
{"level":"debug","ts":"2026-07-22T02:28:44Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"30c1e287-d96a-4171-9afd-cc64baf51be6","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-000830.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"d061b746-2166-43af-b645-8cd3c228a74b","keyName":"e2e-rate-a-9f1aeb","subscription":"e2e-rate-iso-a-9f1aeb","tenant":"e2e-shared-a-000830","userId":"d061b746-2166-43af-b645-8cd3c228a74b","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-22T02:28:44Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"30c1e287-d96a-4171-9afd-cc64baf51be6","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-000830.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-000830/rate-test-model-000830\",\"requestedSubscription\":\"e2e-rate-iso-a-9f1aeb\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-22T02:28:44Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"30c1e287-d96a-4171-9afd-cc64baf51be6","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-000830.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-000830","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-9f1aeb","namespace":"ai-tenant-e2e-shared-a-000830","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-000830/rate-test-model-000830"}}
{"level":"debug","ts":"2026-07-22T02:28:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"30c1e287-d96a-4171-9afd-cc64baf51be6","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T02:28:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"30c1e287-d96a-4171-9afd-cc64baf51be6","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T02:28:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"30c1e287-d96a-4171-9afd-cc64baf51be6","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T02:28:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"30c1e287-d96a-4171-9afd-cc64baf51be6","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-000830/rate-test-model-000830\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-000830/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T02:28:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"30c1e287-d96a-4171-9afd-cc64baf51be6","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T02:28:44Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"30c1e287-d96a-4171-9afd-cc64baf51be6","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-22T02:28:44Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"30c1e287-d96a-4171-9afd-cc64baf51be6","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-22T02:28:44Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"30c1e287-d96a-4171-9afd-cc64baf51be6","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-9f1aeb"}
{"level":"debug","ts":"2026-07-22T02:28:44Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"30c1e287-d96a-4171-9afd-cc64baf51be6","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"d061b746-2166-43af-b645-8cd3c228a74b","keyName":"e2e-rate-a-9f1aeb","selected_subscription":"e2e-rate-iso-a-9f1aeb","selected_subscription_key":"ai-tenant-e2e-shared-a-000830/e2e-rate-iso-a-9f1aeb@ai-tenant-e2e-shared-a-000830/rate-test-model-000830","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-000830","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-9f1aeb","namespace":"ai-tenant-e2e-shared-a-000830","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-000830/rate-test-model-000830"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-22T02:28:44Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"30c1e287-d96a-4171-9afd-cc64baf51be6","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-22T02:28:44Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"30c1e287-d96a-4171-9afd-cc64baf51be6","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-22T02:28:45Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5007d4b1-86f3-48e9-af81-fda8cc565c4d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.14:56940","PortSpecifier":{"PortValue":56940}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"5007d4b1-86f3-48e9-af81-fda8cc565c4d","method":"POST","path":"/ai-tenant-e2e-shared-a-000830/rate-test-model-000830/v1/completions","host":"e2e-shared-a-000830.apps.baac7630-667b-48fb-8c97-fe8ebd588071.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-22T02:28:45Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5007d4b1-86f3-48e9-af81-fda8cc565c4d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.14:56940","PortSpecifier":{"PortValue":56940}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784687325,"nanos":858806221},"http":{"id":"5007d4b1-86f3-48e9-af81-fda8cc565c4d","method":"POST","headers":{":authority":"e2e-shared-a-000830.apps.baac7630-667b-48fb-8c97-fe8ebd588071.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-000830/rate-test-model-000830/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T02:28:45Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"5007d4b1-86f3-48e9-af81-fda8cc565c4d","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-ULvgSIylbiP6BvKm_7e69l0NROR3fUvHgQ7najmgiwD60WEWKVqf8Ucz2qkn"}
{"level":"debug","ts":"2026-07-22T02:28:45Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"5007d4b1-86f3-48e9-af81-fda8cc565c4d","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-000830.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-ULvgSIylbiP6BvKm_7e69l0NROR3fUvHgQ7najmgiwD60WEWKVqf8Ucz2qkn\"}"}
{"level":"debug","ts":"2026-07-22T02:28:45Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"5007d4b1-86f3-48e9-af81-fda8cc565c4d","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-000830.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"d061b746-2166-43af-b645-8cd3c228a74b","keyName":"e2e-rate-a-9f1aeb","subscription":"e2e-rate-iso-a-9f1aeb","tenant":"e2e-shared-a-000830","userId":"d061b746-2166-43af-b645-8cd3c228a74b","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-22T02:28:45Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"5007d4b1-86f3-48e9-af81-fda8cc565c4d","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-000830.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-000830/rate-test-model-000830\",\"requestedSubscription\":\"e2e-rate-iso-a-9f1aeb\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-22T02:28:45Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"5007d4b1-86f3-48e9-af81-fda8cc565c4d","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-000830.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-000830","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-9f1aeb","namespace":"ai-tenant-e2e-shared-a-000830","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-000830/rate-test-model-000830"}}
{"level":"debug","ts":"2026-07-22T02:28:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"5007d4b1-86f3-48e9-af81-fda8cc565c4d","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T02:28:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5007d4b1-86f3-48e9-af81-fda8cc565c4d","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T02:28:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5007d4b1-86f3-48e9-af81-fda8cc565c4d","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T02:28:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5007d4b1-86f3-48e9-af81-fda8cc565c4d","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T02:28:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5007d4b1-86f3-48e9-af81-fda8cc565c4d","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-000830/rate-test-model-000830\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-000830/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T02:28:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5007d4b1-86f3-48e9-af81-fda8cc565c4d","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-22T02:28:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5007d4b1-86f3-48e9-af81-fda8cc565c4d","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-22T02:28:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5007d4b1-86f3-48e9-af81-fda8cc565c4d","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-9f1aeb"}
{"level":"debug","ts":"2026-07-22T02:28:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5007d4b1-86f3-48e9-af81-fda8cc565c4d","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"d061b746-2166-43af-b645-8cd3c228a74b","keyName":"e2e-rate-a-9f1aeb","selected_subscription":"e2e-rate-iso-a-9f1aeb","selected_subscription_key":"ai-tenant-e2e-shared-a-000830/e2e-rate-iso-a-9f1aeb@ai-tenant-e2e-shared-a-000830/rate-test-model-000830","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-000830","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-9f1aeb","namespace":"ai-tenant-e2e-shared-a-000830","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-000830/rate-test-model-000830"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-22T02:28:45Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5007d4b1-86f3-48e9-af81-fda8cc565c4d","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-22T02:28:45Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5007d4b1-86f3-48e9-af81-fda8cc565c4d","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-22T02:28:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f99e42cc-4803-45a3-b3af-9dcdab6404fe","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.14:56946","PortSpecifier":{"PortValue":56946}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"f99e42cc-4803-45a3-b3af-9dcdab6404fe","method":"POST","path":"/ai-tenant-e2e-shared-a-000830/rate-test-model-000830/v1/completions","host":"e2e-shared-a-000830.apps.baac7630-667b-48fb-8c97-fe8ebd588071.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-22T02:28:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f99e42cc-4803-45a3-b3af-9dcdab6404fe","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.14:56946","PortSpecifier":{"PortValue":56946}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784687326,"nanos":894986420},"http":{"id":"f99e42cc-4803-45a3-b3af-9dcdab6404fe","method":"POST","headers":{":authority":"e2e-shared-a-000830.apps.baac7630-667b-48fb-8c97-fe8ebd588071.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-000830/rate-test-model-000830/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T02:28:46Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"f99e42cc-4803-45a3-b3af-9dcdab6404fe","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-ULvgSIylbiP6BvKm_7e69l0NROR3fUvHgQ7najmgiwD60WEWKVqf8Ucz2qkn"}
{"level":"debug","ts":"2026-07-22T02:28:46Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"f99e42cc-4803-45a3-b3af-9dcdab6404fe","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-000830.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-ULvgSIylbiP6BvKm_7e69l0NROR3fUvHgQ7najmgiwD60WEWKVqf8Ucz2qkn\"}"}
{"level":"debug","ts":"2026-07-22T02:28:46Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"f99e42cc-4803-45a3-b3af-9dcdab6404fe","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-000830.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"d061b746-2166-43af-b645-8cd3c228a74b","keyName":"e2e-rate-a-9f1aeb","subscription":"e2e-rate-iso-a-9f1aeb","tenant":"e2e-shared-a-000830","userId":"d061b746-2166-43af-b645-8cd3c228a74b","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-22T02:28:46Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"f99e42cc-4803-45a3-b3af-9dcdab6404fe","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-000830.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-000830/rate-test-model-000830\",\"requestedSubscription\":\"e2e-rate-iso-a-9f1aeb\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-22T02:28:46Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"f99e42cc-4803-45a3-b3af-9dcdab6404fe","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-000830.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-000830","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-9f1aeb","namespace":"ai-tenant-e2e-shared-a-000830","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-000830/rate-test-model-000830"}}
{"level":"debug","ts":"2026-07-22T02:28:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"f99e42cc-4803-45a3-b3af-9dcdab6404fe","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T02:28:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f99e42cc-4803-45a3-b3af-9dcdab6404fe","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T02:28:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f99e42cc-4803-45a3-b3af-9dcdab6404fe","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T02:28:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f99e42cc-4803-45a3-b3af-9dcdab6404fe","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T02:28:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f99e42cc-4803-45a3-b3af-9dcdab6404fe","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-000830/rate-test-model-000830\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-000830/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T02:28:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f99e42cc-4803-45a3-b3af-9dcdab6404fe","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-22T02:28:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f99e42cc-4803-45a3-b3af-9dcdab6404fe","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-22T02:28:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f99e42cc-4803-45a3-b3af-9dcdab6404fe","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-9f1aeb"}
{"level":"debug","ts":"2026-07-22T02:28:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f99e42cc-4803-45a3-b3af-9dcdab6404fe","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"d061b746-2166-43af-b645-8cd3c228a74b","keyName":"e2e-rate-a-9f1aeb","selected_subscription":"e2e-rate-iso-a-9f1aeb","selected_subscription_key":"ai-tenant-e2e-shared-a-000830/e2e-rate-iso-a-9f1aeb@ai-tenant-e2e-shared-a-000830/rate-test-model-000830","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-000830","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-9f1aeb","namespace":"ai-tenant-e2e-shared-a-000830","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-000830/rate-test-model-000830"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-22T02:28:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f99e42cc-4803-45a3-b3af-9dcdab6404fe","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-22T02:28:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f99e42cc-4803-45a3-b3af-9dcdab6404fe","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-22T02:28:55Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0b202bc3-d019-43ca-989c-ec85286ec90c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.14:55504","PortSpecifier":{"PortValue":55504}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"0b202bc3-d019-43ca-989c-ec85286ec90c","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-000830.apps.baac7630-667b-48fb-8c97-fe8ebd588071.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-22T02:28:55Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0b202bc3-d019-43ca-989c-ec85286ec90c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.14:55504","PortSpecifier":{"PortValue":55504}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784687335,"nanos":728047443},"http":{"id":"0b202bc3-d019-43ca-989c-ec85286ec90c","method":"POST","headers":{":authority":"e2e-shared-a-000830.apps.baac7630-667b-48fb-8c97-fe8ebd588071.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T02:28:55Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"0b202bc3-d019-43ca-989c-ec85286ec90c","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-22T02:28:55Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"0b202bc3-d019-43ca-989c-ec85286ec90c","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"ea87c7df-7d44-4a6d-a086-2850f9733702","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=d0ea8cc2-7b86-4b0b-bbc0-db31674de9e3"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/fe8ebd588071"]}}
{"level":"debug","ts":"2026-07-22T02:28:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"0b202bc3-d019-43ca-989c-ec85286ec90c","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/fe8ebd588071"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=d0ea8cc2-7b86-4b0b-bbc0-db31674de9e3"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"ea87c7df-7d44-4a6d-a086-2850f9733702","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"a6605766b33397fe445fbf5f984eb76a25792129c410c06dedafacd2ba447ec0"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.54:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-000830.apps.baac7630-667b-48fb-8c97-fe8ebd588071.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T02:28:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0b202bc3-d019-43ca-989c-ec85286ec90c","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T02:28:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0b202bc3-d019-43ca-989c-ec85286ec90c","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T02:28:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0b202bc3-d019-43ca-989c-ec85286ec90c","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-000830/rate-test-model-000830\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-000830/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T02:28:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"0b202bc3-d019-43ca-989c-ec85286ec90c","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-22T02:28:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0b202bc3-d019-43ca-989c-ec85286ec90c","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-22T02:28:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0b202bc3-d019-43ca-989c-ec85286ec90c","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-22T02:28:55Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0b202bc3-d019-43ca-989c-ec85286ec90c","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-22T02:28:55Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0b202bc3-d019-43ca-989c-ec85286ec90c","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-22T02:28:55Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5712fdad-6dec-4d1e-98b9-e560e3b04997","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.14:60260","PortSpecifier":{"PortValue":60260}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"5712fdad-6dec-4d1e-98b9-e560e3b04997","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-7eead4.apps.baac7630-667b-48fb-8c97-fe8ebd588071.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-22T02:28:55Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5712fdad-6dec-4d1e-98b9-e560e3b04997","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.14:60260","PortSpecifier":{"PortValue":60260}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784687335,"nanos":764505544},"http":{"id":"5712fdad-6dec-4d1e-98b9-e560e3b04997","method":"POST","headers":{":authority":"e2e-shared-b-7eead4.apps.baac7630-667b-48fb-8c97-fe8ebd588071.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T02:28:55Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"5712fdad-6dec-4d1e-98b9-e560e3b04997","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-22T02:28:55Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"5712fdad-6dec-4d1e-98b9-e560e3b04997","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"ea87c7df-7d44-4a6d-a086-2850f9733702","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=d0ea8cc2-7b86-4b0b-bbc0-db31674de9e3"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/fe8ebd588071"]}}
{"level":"debug","ts":"2026-07-22T02:28:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"5712fdad-6dec-4d1e-98b9-e560e3b04997","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/fe8ebd588071"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=d0ea8cc2-7b86-4b0b-bbc0-db31674de9e3"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"ea87c7df-7d44-4a6d-a086-2850f9733702","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"98d1603eab1b1b64f57908cf3ce3206543ba8a79c2670cd063a7e58d4ec62a48"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.134.0.55:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-7eead4.apps.baac7630-667b-48fb-8c97-fe8ebd588071.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T02:28:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5712fdad-6dec-4d1e-98b9-e560e3b04997","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T02:28:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5712fdad-6dec-4d1e-98b9-e560e3b04997","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T02:28:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5712fdad-6dec-4d1e-98b9-e560e3b04997","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-7eead4/rate-test-model-7eead4\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-7eead4/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T02:28:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"5712fdad-6dec-4d1e-98b9-e560e3b04997","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-22T02:28:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5712fdad-6dec-4d1e-98b9-e560e3b04997","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-22T02:28:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5712fdad-6dec-4d1e-98b9-e560e3b04997","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-22T02:28:55Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5712fdad-6dec-4d1e-98b9-e560e3b04997","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-22T02:28:55Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5712fdad-6dec-4d1e-98b9-e560e3b04997","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-22T02:28:55Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a0632b6d-479b-44fc-8f8c-2f48ad162333","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.14:55520","PortSpecifier":{"PortValue":55520}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"a0632b6d-479b-44fc-8f8c-2f48ad162333","method":"POST","path":"/ai-tenant-e2e-shared-a-000830/rate-test-model-000830/v1/completions","host":"e2e-shared-a-000830.apps.baac7630-667b-48fb-8c97-fe8ebd588071.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-22T02:28:55Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a0632b6d-479b-44fc-8f8c-2f48ad162333","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.14:55520","PortSpecifier":{"PortValue":55520}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784687335,"nanos":801176604},"http":{"id":"a0632b6d-479b-44fc-8f8c-2f48ad162333","method":"POST","headers":{":authority":"e2e-shared-a-000830.apps.baac7630-667b-48fb-8c97-fe8ebd588071.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-000830/rate-test-model-000830/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T02:28:55Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"a0632b6d-479b-44fc-8f8c-2f48ad162333","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-yQajz1zwuXoyfBW0_709g5ocNDjjdpsLWMaUA0L9K69kHgKZ2U2uY9fFFMC7"}
{"level":"debug","ts":"2026-07-22T02:28:55Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a0632b6d-479b-44fc-8f8c-2f48ad162333","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-000830.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-yQajz1zwuXoyfBW0_709g5ocNDjjdpsLWMaUA0L9K69kHgKZ2U2uY9fFFMC7\"}"}
{"level":"debug","ts":"2026-07-22T02:28:55Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a0632b6d-479b-44fc-8f8c-2f48ad162333","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-000830.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"486fe623-21d7-4d24-bae4-e1a6aa550f09","keyName":"e2e-rate-a-bd22ee","subscription":"e2e-rate-iso-a-bd22ee","tenant":"e2e-shared-a-000830","userId":"486fe623-21d7-4d24-bae4-e1a6aa550f09","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-22T02:28:55Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a0632b6d-479b-44fc-8f8c-2f48ad162333","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-000830.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-000830/rate-test-model-000830\",\"requestedSubscription\":\"e2e-rate-iso-a-bd22ee\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-22T02:28:55Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a0632b6d-479b-44fc-8f8c-2f48ad162333","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-000830.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-000830","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-bd22ee","namespace":"ai-tenant-e2e-shared-a-000830","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-000830/rate-test-model-000830"}}
{"level":"debug","ts":"2026-07-22T02:28:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"a0632b6d-479b-44fc-8f8c-2f48ad162333","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T02:28:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a0632b6d-479b-44fc-8f8c-2f48ad162333","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T02:28:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a0632b6d-479b-44fc-8f8c-2f48ad162333","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T02:28:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a0632b6d-479b-44fc-8f8c-2f48ad162333","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T02:28:55Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a0632b6d-479b-44fc-8f8c-2f48ad162333","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-000830/rate-test-model-000830\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-000830/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T02:28:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a0632b6d-479b-44fc-8f8c-2f48ad162333","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-22T02:28:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a0632b6d-479b-44fc-8f8c-2f48ad162333","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-bd22ee"}
{"level":"debug","ts":"2026-07-22T02:28:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a0632b6d-479b-44fc-8f8c-2f48ad162333","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-22T02:28:55Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a0632b6d-479b-44fc-8f8c-2f48ad162333","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"486fe623-21d7-4d24-bae4-e1a6aa550f09","keyName":"e2e-rate-a-bd22ee","selected_subscription":"e2e-rate-iso-a-bd22ee","selected_subscription_key":"ai-tenant-e2e-shared-a-000830/e2e-rate-iso-a-bd22ee@ai-tenant-e2e-shared-a-000830/rate-test-model-000830","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-000830","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-bd22ee","namespace":"ai-tenant-e2e-shared-a-000830","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-000830/rate-test-model-000830"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-22T02:28:55Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a0632b6d-479b-44fc-8f8c-2f48ad162333","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-22T02:28:55Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a0632b6d-479b-44fc-8f8c-2f48ad162333","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-22T02:28:56Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a7baec4c-f036-4eec-a1ab-b0ad800dbd7d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.14:55524","PortSpecifier":{"PortValue":55524}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"a7baec4c-f036-4eec-a1ab-b0ad800dbd7d","method":"POST","path":"/ai-tenant-e2e-shared-a-000830/rate-test-model-000830/v1/completions","host":"e2e-shared-a-000830.apps.baac7630-667b-48fb-8c97-fe8ebd588071.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-22T02:28:56Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a7baec4c-f036-4eec-a1ab-b0ad800dbd7d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.14:55524","PortSpecifier":{"PortValue":55524}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784687336,"nanos":837249864},"http":{"id":"a7baec4c-f036-4eec-a1ab-b0ad800dbd7d","method":"POST","headers":{":authority":"e2e-shared-a-000830.apps.baac7630-667b-48fb-8c97-fe8ebd588071.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-000830/rate-test-model-000830/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T02:28:56Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"a7baec4c-f036-4eec-a1ab-b0ad800dbd7d","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-yQajz1zwuXoyfBW0_709g5ocNDjjdpsLWMaUA0L9K69kHgKZ2U2uY9fFFMC7"}
{"level":"debug","ts":"2026-07-22T02:28:56Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a7baec4c-f036-4eec-a1ab-b0ad800dbd7d","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-000830.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-yQajz1zwuXoyfBW0_709g5ocNDjjdpsLWMaUA0L9K69kHgKZ2U2uY9fFFMC7\"}"}
{"level":"debug","ts":"2026-07-22T02:28:56Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a7baec4c-f036-4eec-a1ab-b0ad800dbd7d","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-000830.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"486fe623-21d7-4d24-bae4-e1a6aa550f09","keyName":"e2e-rate-a-bd22ee","subscription":"e2e-rate-iso-a-bd22ee","tenant":"e2e-shared-a-000830","userId":"486fe623-21d7-4d24-bae4-e1a6aa550f09","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-22T02:28:56Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a7baec4c-f036-4eec-a1ab-b0ad800dbd7d","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-000830.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-000830/rate-test-model-000830\",\"requestedSubscription\":\"e2e-rate-iso-a-bd22ee\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-22T02:28:56Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a7baec4c-f036-4eec-a1ab-b0ad800dbd7d","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-000830.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-000830","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-bd22ee","namespace":"ai-tenant-e2e-shared-a-000830","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-000830/rate-test-model-000830"}}
{"level":"debug","ts":"2026-07-22T02:28:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"a7baec4c-f036-4eec-a1ab-b0ad800dbd7d","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T02:28:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a7baec4c-f036-4eec-a1ab-b0ad800dbd7d","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T02:28:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a7baec4c-f036-4eec-a1ab-b0ad800dbd7d","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T02:28:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a7baec4c-f036-4eec-a1ab-b0ad800dbd7d","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T02:28:56Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a7baec4c-f036-4eec-a1ab-b0ad800dbd7d","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-000830/rate-test-model-000830\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-000830/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T02:28:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a7baec4c-f036-4eec-a1ab-b0ad800dbd7d","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-22T02:28:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a7baec4c-f036-4eec-a1ab-b0ad800dbd7d","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-bd22ee"}
{"level":"debug","ts":"2026-07-22T02:28:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a7baec4c-f036-4eec-a1ab-b0ad800dbd7d","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-22T02:28:56Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a7baec4c-f036-4eec-a1ab-b0ad800dbd7d","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"486fe623-21d7-4d24-bae4-e1a6aa550f09","keyName":"e2e-rate-a-bd22ee","selected_subscription":"e2e-rate-iso-a-bd22ee","selected_subscription_key":"ai-tenant-e2e-shared-a-000830/e2e-rate-iso-a-bd22ee@ai-tenant-e2e-shared-a-000830/rate-test-model-000830","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-000830","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-bd22ee","namespace":"ai-tenant-e2e-shared-a-000830","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-000830/rate-test-model-000830"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-22T02:28:56Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a7baec4c-f036-4eec-a1ab-b0ad800dbd7d","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-22T02:28:56Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a7baec4c-f036-4eec-a1ab-b0ad800dbd7d","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-22T02:28:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"32aee0fb-a3ce-4506-9a58-58712678c1e5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.14:55530","PortSpecifier":{"PortValue":55530}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"32aee0fb-a3ce-4506-9a58-58712678c1e5","method":"POST","path":"/ai-tenant-e2e-shared-a-000830/rate-test-model-000830/v1/completions","host":"e2e-shared-a-000830.apps.baac7630-667b-48fb-8c97-fe8ebd588071.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-22T02:28:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"32aee0fb-a3ce-4506-9a58-58712678c1e5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.14:55530","PortSpecifier":{"PortValue":55530}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.54:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784687337,"nanos":871594202},"http":{"id":"32aee0fb-a3ce-4506-9a58-58712678c1e5","method":"POST","headers":{":authority":"e2e-shared-a-000830.apps.baac7630-667b-48fb-8c97-fe8ebd588071.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-000830/rate-test-model-000830/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T02:28:57Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"32aee0fb-a3ce-4506-9a58-58712678c1e5","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-yQajz1zwuXoyfBW0_709g5ocNDjjdpsLWMaUA0L9K69kHgKZ2U2uY9fFFMC7"}
{"level":"debug","ts":"2026-07-22T02:28:57Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"32aee0fb-a3ce-4506-9a58-58712678c1e5","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-000830.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-yQajz1zwuXoyfBW0_709g5ocNDjjdpsLWMaUA0L9K69kHgKZ2U2uY9fFFMC7\"}"}
{"level":"debug","ts":"2026-07-22T02:28:57Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"32aee0fb-a3ce-4506-9a58-58712678c1e5","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-000830.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"486fe623-21d7-4d24-bae4-e1a6aa550f09","keyName":"e2e-rate-a-bd22ee","subscription":"e2e-rate-iso-a-bd22ee","tenant":"e2e-shared-a-000830","userId":"486fe623-21d7-4d24-bae4-e1a6aa550f09","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-22T02:28:57Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"32aee0fb-a3ce-4506-9a58-58712678c1e5","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-000830.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-000830/rate-test-model-000830\",\"requestedSubscription\":\"e2e-rate-iso-a-bd22ee\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-22T02:28:57Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"32aee0fb-a3ce-4506-9a58-58712678c1e5","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-000830.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-000830","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-bd22ee","namespace":"ai-tenant-e2e-shared-a-000830","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-000830/rate-test-model-000830"}}
{"level":"debug","ts":"2026-07-22T02:28:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"32aee0fb-a3ce-4506-9a58-58712678c1e5","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T02:28:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"32aee0fb-a3ce-4506-9a58-58712678c1e5","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T02:28:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"32aee0fb-a3ce-4506-9a58-58712678c1e5","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T02:28:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"32aee0fb-a3ce-4506-9a58-58712678c1e5","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T02:28:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"32aee0fb-a3ce-4506-9a58-58712678c1e5","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-000830/rate-test-model-000830\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-000830/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T02:28:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"32aee0fb-a3ce-4506-9a58-58712678c1e5","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-22T02:28:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"32aee0fb-a3ce-4506-9a58-58712678c1e5","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-bd22ee"}
{"level":"debug","ts":"2026-07-22T02:28:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"32aee0fb-a3ce-4506-9a58-58712678c1e5","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-22T02:28:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"32aee0fb-a3ce-4506-9a58-58712678c1e5","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"486fe623-21d7-4d24-bae4-e1a6aa550f09","keyName":"e2e-rate-a-bd22ee","selected_subscription":"e2e-rate-iso-a-bd22ee","selected_subscription_key":"ai-tenant-e2e-shared-a-000830/e2e-rate-iso-a-bd22ee@ai-tenant-e2e-shared-a-000830/rate-test-model-000830","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-000830","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-bd22ee","namespace":"ai-tenant-e2e-shared-a-000830","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-000830/rate-test-model-000830"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-22T02:28:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"32aee0fb-a3ce-4506-9a58-58712678c1e5","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-22T02:28:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"32aee0fb-a3ce-4506-9a58-58712678c1e5","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-22T02:28:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5185d47e-db2f-4719-bda8-5b50ec195006","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.14:60274","PortSpecifier":{"PortValue":60274}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"5185d47e-db2f-4719-bda8-5b50ec195006","method":"POST","path":"/ai-tenant-e2e-shared-b-7eead4/rate-test-model-7eead4/v1/completions","host":"e2e-shared-b-7eead4.apps.baac7630-667b-48fb-8c97-fe8ebd588071.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-22T02:28:57Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5185d47e-db2f-4719-bda8-5b50ec195006","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.14:60274","PortSpecifier":{"PortValue":60274}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.134.0.55:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784687337,"nanos":906198890},"http":{"id":"5185d47e-db2f-4719-bda8-5b50ec195006","method":"POST","headers":{":authority":"e2e-shared-b-7eead4.apps.baac7630-667b-48fb-8c97-fe8ebd588071.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-b-7eead4/rate-test-model-7eead4/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T02:28:57Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"5185d47e-db2f-4719-bda8-5b50ec195006","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-INN1BnZZifqih9mm_Y0XkElbmFzWqvdQsUFtuVA5SqMKA3Um12Vb5ohhp4Pd"}
{"level":"debug","ts":"2026-07-22T02:28:57Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"5185d47e-db2f-4719-bda8-5b50ec195006","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-b-7eead4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-INN1BnZZifqih9mm_Y0XkElbmFzWqvdQsUFtuVA5SqMKA3Um12Vb5ohhp4Pd\"}"}
{"level":"debug","ts":"2026-07-22T02:28:57Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"5185d47e-db2f-4719-bda8-5b50ec195006","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-7eead4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"f2230157-611f-4b60-901b-a61264ad282f","keyName":"e2e-rate-b-bd22ee","subscription":"e2e-rate-iso-b-bd22ee","tenant":"e2e-shared-b-7eead4","userId":"f2230157-611f-4b60-901b-a61264ad282f","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-22T02:28:57Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"5185d47e-db2f-4719-bda8-5b50ec195006","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-b-7eead4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-b-7eead4/rate-test-model-7eead4\",\"requestedSubscription\":\"e2e-rate-iso-b-bd22ee\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-22T02:28:57Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"5185d47e-db2f-4719-bda8-5b50ec195006","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-7eead4.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-7eead4","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-bd22ee","namespace":"ai-tenant-e2e-shared-b-7eead4","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-b-7eead4/rate-test-model-7eead4"}}
{"level":"debug","ts":"2026-07-22T02:28:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"5185d47e-db2f-4719-bda8-5b50ec195006","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-22T02:28:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5185d47e-db2f-4719-bda8-5b50ec195006","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T02:28:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5185d47e-db2f-4719-bda8-5b50ec195006","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T02:28:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5185d47e-db2f-4719-bda8-5b50ec195006","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T02:28:57Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5185d47e-db2f-4719-bda8-5b50ec195006","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-7eead4/rate-test-model-7eead4\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-7eead4/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-22T02:28:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5185d47e-db2f-4719-bda8-5b50ec195006","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-b-bd22ee"}
{"level":"debug","ts":"2026-07-22T02:28:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5185d47e-db2f-4719-bda8-5b50ec195006","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-22T02:28:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5185d47e-db2f-4719-bda8-5b50ec195006","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-22T02:28:57Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5185d47e-db2f-4719-bda8-5b50ec195006","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"f2230157-611f-4b60-901b-a61264ad282f","keyName":"e2e-rate-b-bd22ee","selected_subscription":"e2e-rate-iso-b-bd22ee","selected_subscription_key":"ai-tenant-e2e-shared-b-7eead4/e2e-rate-iso-b-bd22ee@ai-tenant-e2e-shared-b-7eead4/rate-test-model-7eead4","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-7eead4","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-bd22ee","namespace":"ai-tenant-e2e-shared-b-7eead4","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-b-7eead4/rate-test-model-7eead4"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-22T02:28:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5185d47e-db2f-4719-bda8-5b50ec195006","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-22T02:28:57Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5185d47e-db2f-4719-bda8-5b50ec195006","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-22T02:29:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/b73d78c2fd1225195efc8a2d5c84696f44b8b29a6d2696ef9f4b80485443f2bb"}
{"level":"info","ts":"2026-07-22T02:29:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/017bef8ad369aedf4693a42b618314a1f78b40210183a1a3e12c6c4db526667e"}
{"level":"info","ts":"2026-07-22T02:29:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/5fdbf5479088293464dd4dabcef1ab9234e359edec1f2e22b5addffea335a85f"}
{"level":"info","ts":"2026-07-22T02:29:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/d4f746357f835389e04bd5a96522f198f7d47065d83d9523850f6afdcd8db8b3"}
{"level":"info","ts":"2026-07-22T02:29:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/f63f911ad20ec8d58908d7286e0c468baa847b130acbd6b55c4950dfd4f2214e"}
{"level":"info","ts":"2026-07-22T02:29:04Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/c34bed99faca4ccf093c04d0bd2d92f45d470b0daf4cae1f07e7136557c40a09"}
{"level":"info","ts":"2026-07-22T02:29:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/3edc01bd2023bb40ffd5a0f803000b23139b11c8fcbd6de50e15105135bb5dfe"}
{"level":"info","ts":"2026-07-22T02:29:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/bf65927c2e995159661cb4d48d34217d059b3a0970b47ab32b70396223719355"}
{"level":"info","ts":"2026-07-22T02:29:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/98d1603eab1b1b64f57908cf3ce3206543ba8a79c2670cd063a7e58d4ec62a48"}
{"level":"info","ts":"2026-07-22T02:29:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/8728ada71d19245c5805e710ea412b706bb84cb988be99570b7c92cac12d02fd"}
{"level":"info","ts":"2026-07-22T02:29:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/a86c535d87f73a7405d50223379da0c4ac8ce54795f786efc0194f29be070ccb"}
{"level":"info","ts":"2026-07-22T02:29:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/47c67cae0f9cf1600d05bf217ab25a874bbafb2d98b28dfc1d5590c9e9683772"}
{"level":"info","ts":"2026-07-22T02:29:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/0106e4f1216de4e8b2e96af0848f40cfa078e4a51b2808215072722924399f8a"}
{"level":"info","ts":"2026-07-22T02:29:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/7e05aa5b212f5a5228cfb7fc933b146391673a6a8a35766c7a79ed7a54262847"}
{"level":"info","ts":"2026-07-22T02:29:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/24990eeeefe2b26fd1e764edf3e286550b5ad5aaf0d8dd9fdbca10c0d719920d"}
{"level":"info","ts":"2026-07-22T02:29:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/a6605766b33397fe445fbf5f984eb76a25792129c410c06dedafacd2ba447ec0"}
{"level":"info","ts":"2026-07-22T02:29:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/ca49896b8dd759a3e630eb1010ea616f15e75588a9d2b05671523a8e434df7d1"}
{"level":"info","ts":"2026-07-22T02:29:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/ab15274616586b718376ae73e81534777714f2b93e19d8b3e074ed577dee096f"}
{"level":"info","ts":"2026-07-22T02:29:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/8155cead5addae80c60ae80fda2fe6e7762360a66b946b9f96b8a6aeb142a752"}
{"level":"info","ts":"2026-07-22T02:29:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/6b0101f48d3950398a9ba432fbcdb8431bb1c98f78ee0c22f78c64e646bdd664"}
{"level":"info","ts":"2026-07-22T02:29:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/1052ea21b2bde5c25b38961de7418c5ec82a5472cef64ce758524569d5140f77"}
{"level":"info","ts":"2026-07-22T02:29:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/a87347e676159f925f532d091c7af7a4f62ac5d1e01cd2f5a192984a4ac74858"}
{"level":"info","ts":"2026-07-22T02:29:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/5481d28448c620ebc6126ed4ad453403cdf551a9ca98012f0c48af3efabdeaa6"}
{"level":"info","ts":"2026-07-22T02:29:05Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/1be94ebf031df9476f3ed66e20d33d184b3ebd42a5b54d97f0677924ed736f47"}