{"level":"info","ts":"2026-07-06T19:49:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2ff98491f198b5f467b1debc1b1636888f5de6257a71ba560c8a0e4cd85b5bfa"}
{"level":"info","ts":"2026-07-06T19:49:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2ff98491f198b5f467b1debc1b1636888f5de6257a71ba560c8a0e4cd85b5bfa","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:49:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c365c3d9a7980630c9083c5dc08703bd99785c7155915fd8db92431277ed9512","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T19:49:33Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T19:49:33Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T19:49:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c365c3d9a7980630c9083c5dc08703bd99785c7155915fd8db92431277ed9512"}
{"level":"info","ts":"2026-07-06T19:49:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c365c3d9a7980630c9083c5dc08703bd99785c7155915fd8db92431277ed9512","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:49:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2ff98491f198b5f467b1debc1b1636888f5de6257a71ba560c8a0e4cd85b5bfa","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:49:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2668715d78393fb0ee754250c37d7081631dafabf4dece9db508e1f8297133af","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T19:49:33Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T19:49:33Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T19:49:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2ff98491f198b5f467b1debc1b1636888f5de6257a71ba560c8a0e4cd85b5bfa"}
{"level":"info","ts":"2026-07-06T19:49:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2668715d78393fb0ee754250c37d7081631dafabf4dece9db508e1f8297133af","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:49:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c365c3d9a7980630c9083c5dc08703bd99785c7155915fd8db92431277ed9512","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T19:49:33Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T19:49:33Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["c365c3d9a7980630c9083c5dc08703bd99785c7155915fd8db92431277ed9512"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T19:49:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2668715d78393fb0ee754250c37d7081631dafabf4dece9db508e1f8297133af"}
{"level":"info","ts":"2026-07-06T19:49:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c365c3d9a7980630c9083c5dc08703bd99785c7155915fd8db92431277ed9512","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:49:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2ff98491f198b5f467b1debc1b1636888f5de6257a71ba560c8a0e4cd85b5bfa","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T19:49:33Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T19:49:33Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["2ff98491f198b5f467b1debc1b1636888f5de6257a71ba560c8a0e4cd85b5bfa"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T19:49:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c365c3d9a7980630c9083c5dc08703bd99785c7155915fd8db92431277ed9512"}
{"level":"info","ts":"2026-07-06T19:49:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2ff98491f198b5f467b1debc1b1636888f5de6257a71ba560c8a0e4cd85b5bfa","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:49:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2668715d78393fb0ee754250c37d7081631dafabf4dece9db508e1f8297133af","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T19:49:33Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T19:49:33Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T19:49:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2668715d78393fb0ee754250c37d7081631dafabf4dece9db508e1f8297133af","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:49:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c365c3d9a7980630c9083c5dc08703bd99785c7155915fd8db92431277ed9512","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:49:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2ff98491f198b5f467b1debc1b1636888f5de6257a71ba560c8a0e4cd85b5bfa","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:49:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2668715d78393fb0ee754250c37d7081631dafabf4dece9db508e1f8297133af","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T19:49:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2668715d78393fb0ee754250c37d7081631dafabf4dece9db508e1f8297133af"}
{"level":"debug","ts":"2026-07-06T19:49:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2668715d78393fb0ee754250c37d7081631dafabf4dece9db508e1f8297133af","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T19:49:33Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T19:49:33Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["2668715d78393fb0ee754250c37d7081631dafabf4dece9db508e1f8297133af"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T19:49:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c365c3d9a7980630c9083c5dc08703bd99785c7155915fd8db92431277ed9512"}
{"level":"info","ts":"2026-07-06T19:49:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2668715d78393fb0ee754250c37d7081631dafabf4dece9db508e1f8297133af","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:49:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2668715d78393fb0ee754250c37d7081631dafabf4dece9db508e1f8297133af","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T19:49:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2ff98491f198b5f467b1debc1b1636888f5de6257a71ba560c8a0e4cd85b5bfa"}
{"level":"info","ts":"2026-07-06T19:49:33Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2668715d78393fb0ee754250c37d7081631dafabf4dece9db508e1f8297133af"}
{"level":"debug","ts":"2026-07-06T19:49:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9ff6fecce76e8332a1a04ac88654458100199a11cc2c9ed9915aeabc27da476a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T19:49:46Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T19:49:46Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T19:49:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9ff6fecce76e8332a1a04ac88654458100199a11cc2c9ed9915aeabc27da476a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:49:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9ff6fecce76e8332a1a04ac88654458100199a11cc2c9ed9915aeabc27da476a","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T19:49:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9ff6fecce76e8332a1a04ac88654458100199a11cc2c9ed9915aeabc27da476a"}
{"level":"debug","ts":"2026-07-06T19:49:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9ff6fecce76e8332a1a04ac88654458100199a11cc2c9ed9915aeabc27da476a","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T19:49:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9ff6fecce76e8332a1a04ac88654458100199a11cc2c9ed9915aeabc27da476a"}
{"level":"debug","ts":"2026-07-06T19:49:46Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9ff6fecce76e8332a1a04ac88654458100199a11cc2c9ed9915aeabc27da476a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T19:49:46Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T19:49:46Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["9ff6fecce76e8332a1a04ac88654458100199a11cc2c9ed9915aeabc27da476a"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T19:49:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9ff6fecce76e8332a1a04ac88654458100199a11cc2c9ed9915aeabc27da476a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:49:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9ff6fecce76e8332a1a04ac88654458100199a11cc2c9ed9915aeabc27da476a","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T19:49:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9ff6fecce76e8332a1a04ac88654458100199a11cc2c9ed9915aeabc27da476a"}
{"level":"debug","ts":"2026-07-06T19:49:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ddde2515fc690f87930d9d79f7cb4fa4867c5ae04bd8cdb2ea55d9c4b9ee65cc","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T19:49:47Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T19:49:47Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T19:49:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ddde2515fc690f87930d9d79f7cb4fa4867c5ae04bd8cdb2ea55d9c4b9ee65cc"}
{"level":"info","ts":"2026-07-06T19:49:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ddde2515fc690f87930d9d79f7cb4fa4867c5ae04bd8cdb2ea55d9c4b9ee65cc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:49:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ddde2515fc690f87930d9d79f7cb4fa4867c5ae04bd8cdb2ea55d9c4b9ee65cc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:49:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ddde2515fc690f87930d9d79f7cb4fa4867c5ae04bd8cdb2ea55d9c4b9ee65cc","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T19:49:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ddde2515fc690f87930d9d79f7cb4fa4867c5ae04bd8cdb2ea55d9c4b9ee65cc"}
{"level":"debug","ts":"2026-07-06T19:49:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ddde2515fc690f87930d9d79f7cb4fa4867c5ae04bd8cdb2ea55d9c4b9ee65cc","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T19:49:47Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T19:49:47Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["ddde2515fc690f87930d9d79f7cb4fa4867c5ae04bd8cdb2ea55d9c4b9ee65cc"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T19:49:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ddde2515fc690f87930d9d79f7cb4fa4867c5ae04bd8cdb2ea55d9c4b9ee65cc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:49:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ddde2515fc690f87930d9d79f7cb4fa4867c5ae04bd8cdb2ea55d9c4b9ee65cc","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T19:49:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ddde2515fc690f87930d9d79f7cb4fa4867c5ae04bd8cdb2ea55d9c4b9ee65cc"}
{"level":"debug","ts":"2026-07-06T19:49:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"dd2fe6801aba5bd5aae0ba4297b6e58c1c98b407db4e372040f2acbda32eaa42","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T19:49:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/dd2fe6801aba5bd5aae0ba4297b6e58c1c98b407db4e372040f2acbda32eaa42"}
{"level":"debug","ts":"2026-07-06T19:49:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8120aab7de01a4ecc5198bf575949cc6e9806f4176c2d2757bf3361113830cfd","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T19:49:47Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T19:49:47Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T19:49:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8120aab7de01a4ecc5198bf575949cc6e9806f4176c2d2757bf3361113830cfd","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:49:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8120aab7de01a4ecc5198bf575949cc6e9806f4176c2d2757bf3361113830cfd","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T19:49:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8120aab7de01a4ecc5198bf575949cc6e9806f4176c2d2757bf3361113830cfd"}
{"level":"debug","ts":"2026-07-06T19:49:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8120aab7de01a4ecc5198bf575949cc6e9806f4176c2d2757bf3361113830cfd","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T19:49:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8120aab7de01a4ecc5198bf575949cc6e9806f4176c2d2757bf3361113830cfd"}
{"level":"debug","ts":"2026-07-06T19:49:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8120aab7de01a4ecc5198bf575949cc6e9806f4176c2d2757bf3361113830cfd","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T19:49:47Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T19:49:47Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["8120aab7de01a4ecc5198bf575949cc6e9806f4176c2d2757bf3361113830cfd"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T19:49:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8120aab7de01a4ecc5198bf575949cc6e9806f4176c2d2757bf3361113830cfd","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:49:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8120aab7de01a4ecc5198bf575949cc6e9806f4176c2d2757bf3361113830cfd","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T19:49:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8120aab7de01a4ecc5198bf575949cc6e9806f4176c2d2757bf3361113830cfd"}
{"level":"debug","ts":"2026-07-06T19:49:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"427c0d4c00bfe08378e83a96fcf0b92acae0f899baca774a320076c442cd557d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T19:49:47Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T19:49:47Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T19:49:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"427c0d4c00bfe08378e83a96fcf0b92acae0f899baca774a320076c442cd557d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:49:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"427c0d4c00bfe08378e83a96fcf0b92acae0f899baca774a320076c442cd557d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:49:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"427c0d4c00bfe08378e83a96fcf0b92acae0f899baca774a320076c442cd557d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T19:49:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/427c0d4c00bfe08378e83a96fcf0b92acae0f899baca774a320076c442cd557d"}
{"level":"debug","ts":"2026-07-06T19:49:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"427c0d4c00bfe08378e83a96fcf0b92acae0f899baca774a320076c442cd557d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T19:49:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/427c0d4c00bfe08378e83a96fcf0b92acae0f899baca774a320076c442cd557d"}
{"level":"debug","ts":"2026-07-06T19:49:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"427c0d4c00bfe08378e83a96fcf0b92acae0f899baca774a320076c442cd557d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T19:49:47Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T19:49:47Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["427c0d4c00bfe08378e83a96fcf0b92acae0f899baca774a320076c442cd557d"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T19:49:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"427c0d4c00bfe08378e83a96fcf0b92acae0f899baca774a320076c442cd557d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:49:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"427c0d4c00bfe08378e83a96fcf0b92acae0f899baca774a320076c442cd557d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T19:49:47Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T19:49:47Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T19:49:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"427c0d4c00bfe08378e83a96fcf0b92acae0f899baca774a320076c442cd557d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:49:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"427c0d4c00bfe08378e83a96fcf0b92acae0f899baca774a320076c442cd557d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:49:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"427c0d4c00bfe08378e83a96fcf0b92acae0f899baca774a320076c442cd557d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T19:49:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/427c0d4c00bfe08378e83a96fcf0b92acae0f899baca774a320076c442cd557d"}
{"level":"debug","ts":"2026-07-06T19:49:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"427c0d4c00bfe08378e83a96fcf0b92acae0f899baca774a320076c442cd557d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T19:49:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/427c0d4c00bfe08378e83a96fcf0b92acae0f899baca774a320076c442cd557d"}
{"level":"debug","ts":"2026-07-06T19:49:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"427c0d4c00bfe08378e83a96fcf0b92acae0f899baca774a320076c442cd557d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T19:49:47Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T19:49:47Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["427c0d4c00bfe08378e83a96fcf0b92acae0f899baca774a320076c442cd557d"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T19:49:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"427c0d4c00bfe08378e83a96fcf0b92acae0f899baca774a320076c442cd557d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:49:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"427c0d4c00bfe08378e83a96fcf0b92acae0f899baca774a320076c442cd557d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T19:49:47Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T19:49:47Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T19:49:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"427c0d4c00bfe08378e83a96fcf0b92acae0f899baca774a320076c442cd557d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:49:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c365c3d9a7980630c9083c5dc08703bd99785c7155915fd8db92431277ed9512","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:49:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"427c0d4c00bfe08378e83a96fcf0b92acae0f899baca774a320076c442cd557d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T19:49:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/427c0d4c00bfe08378e83a96fcf0b92acae0f899baca774a320076c442cd557d"}
{"level":"debug","ts":"2026-07-06T19:49:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"427c0d4c00bfe08378e83a96fcf0b92acae0f899baca774a320076c442cd557d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T19:49:47Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T19:49:47Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["427c0d4c00bfe08378e83a96fcf0b92acae0f899baca774a320076c442cd557d"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T19:49:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c365c3d9a7980630c9083c5dc08703bd99785c7155915fd8db92431277ed9512"}
{"level":"info","ts":"2026-07-06T19:49:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"427c0d4c00bfe08378e83a96fcf0b92acae0f899baca774a320076c442cd557d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:49:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"427c0d4c00bfe08378e83a96fcf0b92acae0f899baca774a320076c442cd557d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T19:49:47Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T19:49:47Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T19:49:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"427c0d4c00bfe08378e83a96fcf0b92acae0f899baca774a320076c442cd557d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:49:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"427c0d4c00bfe08378e83a96fcf0b92acae0f899baca774a320076c442cd557d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T19:49:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/427c0d4c00bfe08378e83a96fcf0b92acae0f899baca774a320076c442cd557d"}
{"level":"debug","ts":"2026-07-06T19:49:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"427c0d4c00bfe08378e83a96fcf0b92acae0f899baca774a320076c442cd557d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T19:49:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/427c0d4c00bfe08378e83a96fcf0b92acae0f899baca774a320076c442cd557d"}
{"level":"debug","ts":"2026-07-06T19:49:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"427c0d4c00bfe08378e83a96fcf0b92acae0f899baca774a320076c442cd557d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T19:49:47Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T19:49:47Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["427c0d4c00bfe08378e83a96fcf0b92acae0f899baca774a320076c442cd557d"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T19:49:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"427c0d4c00bfe08378e83a96fcf0b92acae0f899baca774a320076c442cd557d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:49:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"df06657c3e5f45f05d36a5a33f161b6786233f06a4869b0650a2ced94e71b07b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T19:49:47Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T19:49:47Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T19:49:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"df06657c3e5f45f05d36a5a33f161b6786233f06a4869b0650a2ced94e71b07b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:49:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"427c0d4c00bfe08378e83a96fcf0b92acae0f899baca774a320076c442cd557d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:49:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"df06657c3e5f45f05d36a5a33f161b6786233f06a4869b0650a2ced94e71b07b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T19:49:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/df06657c3e5f45f05d36a5a33f161b6786233f06a4869b0650a2ced94e71b07b"}
{"level":"debug","ts":"2026-07-06T19:49:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"df06657c3e5f45f05d36a5a33f161b6786233f06a4869b0650a2ced94e71b07b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T19:49:47Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T19:49:47Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["df06657c3e5f45f05d36a5a33f161b6786233f06a4869b0650a2ced94e71b07b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T19:49:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"df06657c3e5f45f05d36a5a33f161b6786233f06a4869b0650a2ced94e71b07b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:49:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"df06657c3e5f45f05d36a5a33f161b6786233f06a4869b0650a2ced94e71b07b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T19:49:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/427c0d4c00bfe08378e83a96fcf0b92acae0f899baca774a320076c442cd557d"}
{"level":"info","ts":"2026-07-06T19:49:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/df06657c3e5f45f05d36a5a33f161b6786233f06a4869b0650a2ced94e71b07b"}
{"level":"debug","ts":"2026-07-06T19:49:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2431f64af2d2d5cb3b519eed5505b2a814ba8d60a8cc6ed41b96863aa22d6d6c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T19:49:48Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T19:49:48Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T19:49:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2431f64af2d2d5cb3b519eed5505b2a814ba8d60a8cc6ed41b96863aa22d6d6c"}
{"level":"info","ts":"2026-07-06T19:49:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2431f64af2d2d5cb3b519eed5505b2a814ba8d60a8cc6ed41b96863aa22d6d6c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:49:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2431f64af2d2d5cb3b519eed5505b2a814ba8d60a8cc6ed41b96863aa22d6d6c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:49:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"47ed502a92e2e6cf8bd63a3f5767836fe3c1d6c442a9a4d28f12bbf5e4e2356a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:49:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2431f64af2d2d5cb3b519eed5505b2a814ba8d60a8cc6ed41b96863aa22d6d6c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T19:49:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2431f64af2d2d5cb3b519eed5505b2a814ba8d60a8cc6ed41b96863aa22d6d6c"}
{"level":"debug","ts":"2026-07-06T19:49:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2431f64af2d2d5cb3b519eed5505b2a814ba8d60a8cc6ed41b96863aa22d6d6c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T19:49:48Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T19:49:48Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["2431f64af2d2d5cb3b519eed5505b2a814ba8d60a8cc6ed41b96863aa22d6d6c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T19:49:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2431f64af2d2d5cb3b519eed5505b2a814ba8d60a8cc6ed41b96863aa22d6d6c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:49:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4f36961e3230713ed3ca2c9967d5fe795173416a85a588ff324075e836af5e0a","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T19:49:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/47ed502a92e2e6cf8bd63a3f5767836fe3c1d6c442a9a4d28f12bbf5e4e2356a"}
{"level":"debug","ts":"2026-07-06T19:49:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2431f64af2d2d5cb3b519eed5505b2a814ba8d60a8cc6ed41b96863aa22d6d6c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T19:49:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4f36961e3230713ed3ca2c9967d5fe795173416a85a588ff324075e836af5e0a"}
{"level":"debug","ts":"2026-07-06T19:49:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d2d577288c57fd19d06ca6eada6bc2e6b58f59ea76f3470fe526a5f420d07987","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T19:49:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2431f64af2d2d5cb3b519eed5505b2a814ba8d60a8cc6ed41b96863aa22d6d6c"}
{"level":"debug","ts":"2026-07-06T19:49:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c1101112b977ccf76c222970c296baf511efad253f2569ee4cc314de8e16b853","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T19:49:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d2d577288c57fd19d06ca6eada6bc2e6b58f59ea76f3470fe526a5f420d07987"}
{"level":"info","ts":"2026-07-06T19:49:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c1101112b977ccf76c222970c296baf511efad253f2569ee4cc314de8e16b853"}
{"level":"debug","ts":"2026-07-06T19:49:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5b719aefb0e634abddadf32b9c495b9f15f5894ecde38a2feffd0bd0f4144016","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T19:49:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5b719aefb0e634abddadf32b9c495b9f15f5894ecde38a2feffd0bd0f4144016"}
{"level":"debug","ts":"2026-07-06T19:49:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"cabcfd6a15beec0824b3cd01642f70f9e07fbfa40eef03d3f7727b2c76782ea1","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-06T19:49:48Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-06T19:49:48Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T19:49:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"cabcfd6a15beec0824b3cd01642f70f9e07fbfa40eef03d3f7727b2c76782ea1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:49:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"cabcfd6a15beec0824b3cd01642f70f9e07fbfa40eef03d3f7727b2c76782ea1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:49:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"cabcfd6a15beec0824b3cd01642f70f9e07fbfa40eef03d3f7727b2c76782ea1","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T19:49:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/cabcfd6a15beec0824b3cd01642f70f9e07fbfa40eef03d3f7727b2c76782ea1"}
{"level":"debug","ts":"2026-07-06T19:49:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"edee7110ea8a89df5f4b02da22579912199045f81b2d5562018522ac43ec1a2b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:49:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f491cb5bbc137bc21b70f0e384f7a5deadea97d54731592581e27b9b267a46ec","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:49:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"cabcfd6a15beec0824b3cd01642f70f9e07fbfa40eef03d3f7727b2c76782ea1","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T19:49:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/cabcfd6a15beec0824b3cd01642f70f9e07fbfa40eef03d3f7727b2c76782ea1"}
{"level":"debug","ts":"2026-07-06T19:49:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"52658dd5fc2c327e1e4fe7c0c5e3e7caf11950258e3e56c881257cc8467cfef0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:49:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d9bb4d1e1800b339ed05edd79cb5704d94bcee43d5427ecce050ce7e380d36b2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:49:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"cabcfd6a15beec0824b3cd01642f70f9e07fbfa40eef03d3f7727b2c76782ea1","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-06T19:49:48Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-06T19:49:48Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["cabcfd6a15beec0824b3cd01642f70f9e07fbfa40eef03d3f7727b2c76782ea1"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-06T19:49:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/edee7110ea8a89df5f4b02da22579912199045f81b2d5562018522ac43ec1a2b"}
{"level":"info","ts":"2026-07-06T19:49:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"cabcfd6a15beec0824b3cd01642f70f9e07fbfa40eef03d3f7727b2c76782ea1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:49:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a1abb5c385212313ea35df44e0ce273540a15c31397f9189fed9aa9342896be9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:49:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"cabcfd6a15beec0824b3cd01642f70f9e07fbfa40eef03d3f7727b2c76782ea1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:49:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2ff98491f198b5f467b1debc1b1636888f5de6257a71ba560c8a0e4cd85b5bfa","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-06T19:49:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1c5c9e4fa50c8661cb0f2e173115e98c202bbfd1de22c6f3c518e2ab15c9dddb","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T19:49:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f491cb5bbc137bc21b70f0e384f7a5deadea97d54731592581e27b9b267a46ec"}
{"level":"debug","ts":"2026-07-06T19:49:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2668715d78393fb0ee754250c37d7081631dafabf4dece9db508e1f8297133af","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T19:49:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/52658dd5fc2c327e1e4fe7c0c5e3e7caf11950258e3e56c881257cc8467cfef0"}
{"level":"debug","ts":"2026-07-06T19:49:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f4fe118ce81b8c34ddbb09f04a94961e50905ea523599490dc92c8ab9989bfb8","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T19:49:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d9bb4d1e1800b339ed05edd79cb5704d94bcee43d5427ecce050ce7e380d36b2"}
{"level":"debug","ts":"2026-07-06T19:49:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"6dbb08da2531d517aac9433e23ea7ed875454fed3824df7bbff0430b41e5014d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-06T19:49:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a1abb5c385212313ea35df44e0ce273540a15c31397f9189fed9aa9342896be9"}
{"level":"info","ts":"2026-07-06T19:49:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/cabcfd6a15beec0824b3cd01642f70f9e07fbfa40eef03d3f7727b2c76782ea1"}
{"level":"info","ts":"2026-07-06T19:49:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2ff98491f198b5f467b1debc1b1636888f5de6257a71ba560c8a0e4cd85b5bfa"}
{"level":"info","ts":"2026-07-06T19:49:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1c5c9e4fa50c8661cb0f2e173115e98c202bbfd1de22c6f3c518e2ab15c9dddb"}
{"level":"info","ts":"2026-07-06T19:49:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2668715d78393fb0ee754250c37d7081631dafabf4dece9db508e1f8297133af"}
{"level":"info","ts":"2026-07-06T19:49:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f4fe118ce81b8c34ddbb09f04a94961e50905ea523599490dc92c8ab9989bfb8"}
{"level":"info","ts":"2026-07-06T19:49:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/6dbb08da2531d517aac9433e23ea7ed875454fed3824df7bbff0430b41e5014d"}
{"level":"info","ts":"2026-07-06T19:49:49Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f773be3e-76cd-4b69-9dd2-c457f3b676c9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:40110","PortSpecifier":{"PortValue":40110}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"f773be3e-76cd-4b69-9dd2-c457f3b676c9","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-5c92ad.apps.ed6006ff-308f-4519-b84f-e305d9418cee.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T19:49:49Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f773be3e-76cd-4b69-9dd2-c457f3b676c9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:40110","PortSpecifier":{"PortValue":40110}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783367389,"nanos":983841818},"http":{"id":"f773be3e-76cd-4b69-9dd2-c457f3b676c9","method":"POST","headers":{":authority":"e2e-shared-a-5c92ad.apps.ed6006ff-308f-4519-b84f-e305d9418cee.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:49:49Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"f773be3e-76cd-4b69-9dd2-c457f3b676c9","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-06T19:49:49Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"f773be3e-76cd-4b69-9dd2-c457f3b676c9","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"e4e5792c-4d8c-417d-b2a9-857f876f8eeb","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=8fedf5fc-869c-4a73-b2bd-7c3b304bf8ad"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/e305d9418cee"]}}
{"level":"debug","ts":"2026-07-06T19:49:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"f773be3e-76cd-4b69-9dd2-c457f3b676c9","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/e305d9418cee"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=8fedf5fc-869c-4a73-b2bd-7c3b304bf8ad"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"e4e5792c-4d8c-417d-b2a9-857f876f8eeb","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"2431f64af2d2d5cb3b519eed5505b2a814ba8d60a8cc6ed41b96863aa22d6d6c"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.57:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-5c92ad.apps.ed6006ff-308f-4519-b84f-e305d9418cee.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:49:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f773be3e-76cd-4b69-9dd2-c457f3b676c9","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:49:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f773be3e-76cd-4b69-9dd2-c457f3b676c9","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:49:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f773be3e-76cd-4b69-9dd2-c457f3b676c9","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-5c92ad/rate-test-model-5c92ad\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:49:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"f773be3e-76cd-4b69-9dd2-c457f3b676c9","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-06T19:49:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f773be3e-76cd-4b69-9dd2-c457f3b676c9","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-06T19:49:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f773be3e-76cd-4b69-9dd2-c457f3b676c9","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-06T19:49:49Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f773be3e-76cd-4b69-9dd2-c457f3b676c9","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T19:49:49Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f773be3e-76cd-4b69-9dd2-c457f3b676c9","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T19:49:50Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8429e06d-31d8-4724-8d89-846ed7871935","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:42604","PortSpecifier":{"PortValue":42604}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.58:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"8429e06d-31d8-4724-8d89-846ed7871935","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-5f29b8.apps.ed6006ff-308f-4519-b84f-e305d9418cee.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T19:49:50Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8429e06d-31d8-4724-8d89-846ed7871935","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:42604","PortSpecifier":{"PortValue":42604}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.58:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783367390,"nanos":25485690},"http":{"id":"8429e06d-31d8-4724-8d89-846ed7871935","method":"POST","headers":{":authority":"e2e-shared-b-5f29b8.apps.ed6006ff-308f-4519-b84f-e305d9418cee.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:49:50Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"8429e06d-31d8-4724-8d89-846ed7871935","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-06T19:49:50Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"8429e06d-31d8-4724-8d89-846ed7871935","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"e4e5792c-4d8c-417d-b2a9-857f876f8eeb","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=8fedf5fc-869c-4a73-b2bd-7c3b304bf8ad"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/e305d9418cee"]}}
{"level":"debug","ts":"2026-07-06T19:49:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"8429e06d-31d8-4724-8d89-846ed7871935","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/e305d9418cee"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=8fedf5fc-869c-4a73-b2bd-7c3b304bf8ad"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"e4e5792c-4d8c-417d-b2a9-857f876f8eeb","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"4f36961e3230713ed3ca2c9967d5fe795173416a85a588ff324075e836af5e0a"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.58:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-5f29b8.apps.ed6006ff-308f-4519-b84f-e305d9418cee.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:49:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8429e06d-31d8-4724-8d89-846ed7871935","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:49:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8429e06d-31d8-4724-8d89-846ed7871935","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:49:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8429e06d-31d8-4724-8d89-846ed7871935","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-5f29b8/rate-test-model-5f29b8\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:49:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"8429e06d-31d8-4724-8d89-846ed7871935","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"keyName","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-06T19:49:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8429e06d-31d8-4724-8d89-846ed7871935","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-06T19:49:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8429e06d-31d8-4724-8d89-846ed7871935","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-06T19:49:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8429e06d-31d8-4724-8d89-846ed7871935","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T19:49:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8429e06d-31d8-4724-8d89-846ed7871935","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T19:49:50Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0a722d20-743f-4996-866d-394b130adc80","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:40122","PortSpecifier":{"PortValue":40122}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"0a722d20-743f-4996-866d-394b130adc80","method":"POST","path":"/ai-tenant-e2e-shared-a-5c92ad/rate-test-model-5c92ad/v1/completions","host":"e2e-shared-a-5c92ad.apps.ed6006ff-308f-4519-b84f-e305d9418cee.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T19:49:50Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0a722d20-743f-4996-866d-394b130adc80","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:40122","PortSpecifier":{"PortValue":40122}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783367390,"nanos":62104267},"http":{"id":"0a722d20-743f-4996-866d-394b130adc80","method":"POST","headers":{":authority":"e2e-shared-a-5c92ad.apps.ed6006ff-308f-4519-b84f-e305d9418cee.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-5c92ad/rate-test-model-5c92ad/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:49:50Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"0a722d20-743f-4996-866d-394b130adc80","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1bO3bpJBxr2GwfEiR_6CFwti5aer9FY71dRGLVYIpRMzIDMvXmxlyInaGqDnn"}
{"level":"debug","ts":"2026-07-06T19:49:50Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"0a722d20-743f-4996-866d-394b130adc80","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-5c92ad.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1bO3bpJBxr2GwfEiR_6CFwti5aer9FY71dRGLVYIpRMzIDMvXmxlyInaGqDnn\"}"}
{"level":"debug","ts":"2026-07-06T19:49:50Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"0a722d20-743f-4996-866d-394b130adc80","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-5c92ad.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"13879714-34b7-4890-bab7-b8c6e4df7d74","keyName":"e2e-rate-a-299cb8","subscription":"e2e-rate-iso-a-299cb8","tenant":"e2e-shared-a-5c92ad","userId":"13879714-34b7-4890-bab7-b8c6e4df7d74","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-06T19:49:50Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"0a722d20-743f-4996-866d-394b130adc80","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-5c92ad.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-5c92ad/rate-test-model-5c92ad\",\"requestedSubscription\":\"e2e-rate-iso-a-299cb8\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-06T19:49:50Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"0a722d20-743f-4996-866d-394b130adc80","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-5c92ad.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-5c92ad","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-299cb8","namespace":"ai-tenant-e2e-shared-a-5c92ad","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-06T19:49:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"0a722d20-743f-4996-866d-394b130adc80","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:49:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0a722d20-743f-4996-866d-394b130adc80","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:49:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0a722d20-743f-4996-866d-394b130adc80","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:49:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0a722d20-743f-4996-866d-394b130adc80","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-5c92ad/rate-test-model-5c92ad\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:49:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0a722d20-743f-4996-866d-394b130adc80","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:49:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0a722d20-743f-4996-866d-394b130adc80","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-06T19:49:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0a722d20-743f-4996-866d-394b130adc80","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-06T19:49:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0a722d20-743f-4996-866d-394b130adc80","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-299cb8"}
{"level":"debug","ts":"2026-07-06T19:49:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0a722d20-743f-4996-866d-394b130adc80","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"13879714-34b7-4890-bab7-b8c6e4df7d74","keyName":"e2e-rate-a-299cb8","selected_subscription":"e2e-rate-iso-a-299cb8","selected_subscription_key":"ai-tenant-e2e-shared-a-5c92ad/e2e-rate-iso-a-299cb8@ai-tenant-e2e-shared-a-5c92ad/rate-test-model-5c92ad","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-5c92ad","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-299cb8","namespace":"ai-tenant-e2e-shared-a-5c92ad","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-06T19:49:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0a722d20-743f-4996-866d-394b130adc80","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T19:49:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0a722d20-743f-4996-866d-394b130adc80","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T19:49:51Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"bdb2d85e-8435-4490-a830-c5908a9996a8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:40126","PortSpecifier":{"PortValue":40126}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"bdb2d85e-8435-4490-a830-c5908a9996a8","method":"POST","path":"/ai-tenant-e2e-shared-a-5c92ad/rate-test-model-5c92ad/v1/completions","host":"e2e-shared-a-5c92ad.apps.ed6006ff-308f-4519-b84f-e305d9418cee.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T19:49:51Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"bdb2d85e-8435-4490-a830-c5908a9996a8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:40126","PortSpecifier":{"PortValue":40126}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783367391,"nanos":120936039},"http":{"id":"bdb2d85e-8435-4490-a830-c5908a9996a8","method":"POST","headers":{":authority":"e2e-shared-a-5c92ad.apps.ed6006ff-308f-4519-b84f-e305d9418cee.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-5c92ad/rate-test-model-5c92ad/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:49:51Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"bdb2d85e-8435-4490-a830-c5908a9996a8","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1bO3bpJBxr2GwfEiR_6CFwti5aer9FY71dRGLVYIpRMzIDMvXmxlyInaGqDnn"}
{"level":"debug","ts":"2026-07-06T19:49:51Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"bdb2d85e-8435-4490-a830-c5908a9996a8","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-5c92ad.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1bO3bpJBxr2GwfEiR_6CFwti5aer9FY71dRGLVYIpRMzIDMvXmxlyInaGqDnn\"}"}
{"level":"debug","ts":"2026-07-06T19:49:51Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"bdb2d85e-8435-4490-a830-c5908a9996a8","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-5c92ad.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"13879714-34b7-4890-bab7-b8c6e4df7d74","keyName":"e2e-rate-a-299cb8","subscription":"e2e-rate-iso-a-299cb8","tenant":"e2e-shared-a-5c92ad","userId":"13879714-34b7-4890-bab7-b8c6e4df7d74","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-06T19:49:51Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"bdb2d85e-8435-4490-a830-c5908a9996a8","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-5c92ad.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-5c92ad/rate-test-model-5c92ad\",\"requestedSubscription\":\"e2e-rate-iso-a-299cb8\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-06T19:49:51Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"bdb2d85e-8435-4490-a830-c5908a9996a8","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-5c92ad.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-5c92ad","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-299cb8","namespace":"ai-tenant-e2e-shared-a-5c92ad","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-06T19:49:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"bdb2d85e-8435-4490-a830-c5908a9996a8","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:49:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"bdb2d85e-8435-4490-a830-c5908a9996a8","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:49:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"bdb2d85e-8435-4490-a830-c5908a9996a8","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:49:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"bdb2d85e-8435-4490-a830-c5908a9996a8","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-5c92ad/rate-test-model-5c92ad\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:49:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"bdb2d85e-8435-4490-a830-c5908a9996a8","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:49:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"bdb2d85e-8435-4490-a830-c5908a9996a8","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-06T19:49:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"bdb2d85e-8435-4490-a830-c5908a9996a8","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-06T19:49:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"bdb2d85e-8435-4490-a830-c5908a9996a8","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-299cb8"}
{"level":"debug","ts":"2026-07-06T19:49:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"bdb2d85e-8435-4490-a830-c5908a9996a8","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"13879714-34b7-4890-bab7-b8c6e4df7d74","keyName":"e2e-rate-a-299cb8","selected_subscription":"e2e-rate-iso-a-299cb8","selected_subscription_key":"ai-tenant-e2e-shared-a-5c92ad/e2e-rate-iso-a-299cb8@ai-tenant-e2e-shared-a-5c92ad/rate-test-model-5c92ad","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-5c92ad","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-299cb8","namespace":"ai-tenant-e2e-shared-a-5c92ad","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-06T19:49:51Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"bdb2d85e-8435-4490-a830-c5908a9996a8","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T19:49:51Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"bdb2d85e-8435-4490-a830-c5908a9996a8","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T19:49:52Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f870e03e-40e3-49de-a4e7-52fcafca5562","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:40128","PortSpecifier":{"PortValue":40128}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"f870e03e-40e3-49de-a4e7-52fcafca5562","method":"POST","path":"/ai-tenant-e2e-shared-a-5c92ad/rate-test-model-5c92ad/v1/completions","host":"e2e-shared-a-5c92ad.apps.ed6006ff-308f-4519-b84f-e305d9418cee.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T19:49:52Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f870e03e-40e3-49de-a4e7-52fcafca5562","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:40128","PortSpecifier":{"PortValue":40128}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783367392,"nanos":153582735},"http":{"id":"f870e03e-40e3-49de-a4e7-52fcafca5562","method":"POST","headers":{":authority":"e2e-shared-a-5c92ad.apps.ed6006ff-308f-4519-b84f-e305d9418cee.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-5c92ad/rate-test-model-5c92ad/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:49:52Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"f870e03e-40e3-49de-a4e7-52fcafca5562","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1bO3bpJBxr2GwfEiR_6CFwti5aer9FY71dRGLVYIpRMzIDMvXmxlyInaGqDnn"}
{"level":"debug","ts":"2026-07-06T19:49:52Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"f870e03e-40e3-49de-a4e7-52fcafca5562","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-5c92ad.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1bO3bpJBxr2GwfEiR_6CFwti5aer9FY71dRGLVYIpRMzIDMvXmxlyInaGqDnn\"}"}
{"level":"debug","ts":"2026-07-06T19:49:52Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"f870e03e-40e3-49de-a4e7-52fcafca5562","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-5c92ad.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"13879714-34b7-4890-bab7-b8c6e4df7d74","keyName":"e2e-rate-a-299cb8","subscription":"e2e-rate-iso-a-299cb8","tenant":"e2e-shared-a-5c92ad","userId":"13879714-34b7-4890-bab7-b8c6e4df7d74","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-06T19:49:52Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"f870e03e-40e3-49de-a4e7-52fcafca5562","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-5c92ad.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-5c92ad/rate-test-model-5c92ad\",\"requestedSubscription\":\"e2e-rate-iso-a-299cb8\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-06T19:49:52Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"f870e03e-40e3-49de-a4e7-52fcafca5562","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-5c92ad.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-5c92ad","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-299cb8","namespace":"ai-tenant-e2e-shared-a-5c92ad","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-06T19:49:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"f870e03e-40e3-49de-a4e7-52fcafca5562","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:49:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f870e03e-40e3-49de-a4e7-52fcafca5562","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:49:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f870e03e-40e3-49de-a4e7-52fcafca5562","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:49:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f870e03e-40e3-49de-a4e7-52fcafca5562","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-5c92ad/rate-test-model-5c92ad\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:49:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f870e03e-40e3-49de-a4e7-52fcafca5562","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:49:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f870e03e-40e3-49de-a4e7-52fcafca5562","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-06T19:49:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f870e03e-40e3-49de-a4e7-52fcafca5562","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-299cb8"}
{"level":"debug","ts":"2026-07-06T19:49:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f870e03e-40e3-49de-a4e7-52fcafca5562","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-06T19:49:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f870e03e-40e3-49de-a4e7-52fcafca5562","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"13879714-34b7-4890-bab7-b8c6e4df7d74","keyName":"e2e-rate-a-299cb8","selected_subscription":"e2e-rate-iso-a-299cb8","selected_subscription_key":"ai-tenant-e2e-shared-a-5c92ad/e2e-rate-iso-a-299cb8@ai-tenant-e2e-shared-a-5c92ad/rate-test-model-5c92ad","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-5c92ad","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-299cb8","namespace":"ai-tenant-e2e-shared-a-5c92ad","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-06T19:49:52Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f870e03e-40e3-49de-a4e7-52fcafca5562","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T19:49:52Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f870e03e-40e3-49de-a4e7-52fcafca5562","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T19:49:58Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"46341b09-e964-4bb3-8758-89ebed3b11d5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:50424","PortSpecifier":{"PortValue":50424}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"46341b09-e964-4bb3-8758-89ebed3b11d5","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-5c92ad.apps.ed6006ff-308f-4519-b84f-e305d9418cee.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T19:49:58Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"46341b09-e964-4bb3-8758-89ebed3b11d5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:50424","PortSpecifier":{"PortValue":50424}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783367398,"nanos":766111356},"http":{"id":"46341b09-e964-4bb3-8758-89ebed3b11d5","method":"POST","headers":{":authority":"e2e-shared-a-5c92ad.apps.ed6006ff-308f-4519-b84f-e305d9418cee.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:49:58Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"46341b09-e964-4bb3-8758-89ebed3b11d5","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-06T19:49:58Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"46341b09-e964-4bb3-8758-89ebed3b11d5","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"e4e5792c-4d8c-417d-b2a9-857f876f8eeb","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=8fedf5fc-869c-4a73-b2bd-7c3b304bf8ad"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/e305d9418cee"]}}
{"level":"debug","ts":"2026-07-06T19:49:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"46341b09-e964-4bb3-8758-89ebed3b11d5","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/e305d9418cee"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=8fedf5fc-869c-4a73-b2bd-7c3b304bf8ad"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"e4e5792c-4d8c-417d-b2a9-857f876f8eeb","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"2431f64af2d2d5cb3b519eed5505b2a814ba8d60a8cc6ed41b96863aa22d6d6c"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.57:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-5c92ad.apps.ed6006ff-308f-4519-b84f-e305d9418cee.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:49:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"46341b09-e964-4bb3-8758-89ebed3b11d5","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:49:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"46341b09-e964-4bb3-8758-89ebed3b11d5","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:49:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"46341b09-e964-4bb3-8758-89ebed3b11d5","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-5c92ad/rate-test-model-5c92ad\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:49:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"46341b09-e964-4bb3-8758-89ebed3b11d5","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-06T19:49:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"46341b09-e964-4bb3-8758-89ebed3b11d5","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-06T19:49:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"46341b09-e964-4bb3-8758-89ebed3b11d5","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-06T19:49:58Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"46341b09-e964-4bb3-8758-89ebed3b11d5","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T19:49:58Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"46341b09-e964-4bb3-8758-89ebed3b11d5","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T19:49:58Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0ed4bf4d-de0e-4912-ae3f-272972b03d6d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:44050","PortSpecifier":{"PortValue":44050}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.58:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"0ed4bf4d-de0e-4912-ae3f-272972b03d6d","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-5f29b8.apps.ed6006ff-308f-4519-b84f-e305d9418cee.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T19:49:58Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0ed4bf4d-de0e-4912-ae3f-272972b03d6d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:44050","PortSpecifier":{"PortValue":44050}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.58:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783367398,"nanos":807814364},"http":{"id":"0ed4bf4d-de0e-4912-ae3f-272972b03d6d","method":"POST","headers":{":authority":"e2e-shared-b-5f29b8.apps.ed6006ff-308f-4519-b84f-e305d9418cee.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:49:58Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"0ed4bf4d-de0e-4912-ae3f-272972b03d6d","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-06T19:49:58Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"0ed4bf4d-de0e-4912-ae3f-272972b03d6d","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"e4e5792c-4d8c-417d-b2a9-857f876f8eeb","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=8fedf5fc-869c-4a73-b2bd-7c3b304bf8ad"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/e305d9418cee"]}}
{"level":"debug","ts":"2026-07-06T19:49:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"0ed4bf4d-de0e-4912-ae3f-272972b03d6d","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/e305d9418cee"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=8fedf5fc-869c-4a73-b2bd-7c3b304bf8ad"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"e4e5792c-4d8c-417d-b2a9-857f876f8eeb","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"4f36961e3230713ed3ca2c9967d5fe795173416a85a588ff324075e836af5e0a"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.58:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-5f29b8.apps.ed6006ff-308f-4519-b84f-e305d9418cee.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:49:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0ed4bf4d-de0e-4912-ae3f-272972b03d6d","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:49:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0ed4bf4d-de0e-4912-ae3f-272972b03d6d","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:49:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0ed4bf4d-de0e-4912-ae3f-272972b03d6d","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-5f29b8/rate-test-model-5f29b8\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:49:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"0ed4bf4d-de0e-4912-ae3f-272972b03d6d","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"keyName","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-06T19:49:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0ed4bf4d-de0e-4912-ae3f-272972b03d6d","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-06T19:49:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0ed4bf4d-de0e-4912-ae3f-272972b03d6d","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-06T19:49:58Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0ed4bf4d-de0e-4912-ae3f-272972b03d6d","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T19:49:58Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0ed4bf4d-de0e-4912-ae3f-272972b03d6d","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T19:49:58Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"929b7f0f-54bf-4403-b2c2-819fa774eaa5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:50430","PortSpecifier":{"PortValue":50430}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"929b7f0f-54bf-4403-b2c2-819fa774eaa5","method":"POST","path":"/ai-tenant-e2e-shared-a-5c92ad/rate-test-model-5c92ad/v1/completions","host":"e2e-shared-a-5c92ad.apps.ed6006ff-308f-4519-b84f-e305d9418cee.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T19:49:58Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"929b7f0f-54bf-4403-b2c2-819fa774eaa5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:50430","PortSpecifier":{"PortValue":50430}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783367398,"nanos":841464371},"http":{"id":"929b7f0f-54bf-4403-b2c2-819fa774eaa5","method":"POST","headers":{":authority":"e2e-shared-a-5c92ad.apps.ed6006ff-308f-4519-b84f-e305d9418cee.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-5c92ad/rate-test-model-5c92ad/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:49:58Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"929b7f0f-54bf-4403-b2c2-819fa774eaa5","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1IPm5stXCufLhLNOY_4Bp8jymW2H5iBv56ztQtHKtuqSLcHpOSKx4WPkeNJ0H"}
{"level":"debug","ts":"2026-07-06T19:49:58Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"929b7f0f-54bf-4403-b2c2-819fa774eaa5","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-5c92ad.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1IPm5stXCufLhLNOY_4Bp8jymW2H5iBv56ztQtHKtuqSLcHpOSKx4WPkeNJ0H\"}"}
{"level":"debug","ts":"2026-07-06T19:49:58Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"929b7f0f-54bf-4403-b2c2-819fa774eaa5","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-5c92ad.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"868784d8-87ea-49e9-9260-0b1410b7b9ec","keyName":"e2e-rate-a-ac0f77","subscription":"e2e-rate-iso-a-ac0f77","tenant":"e2e-shared-a-5c92ad","userId":"868784d8-87ea-49e9-9260-0b1410b7b9ec","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-06T19:49:58Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"929b7f0f-54bf-4403-b2c2-819fa774eaa5","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-5c92ad.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-5c92ad/rate-test-model-5c92ad\",\"requestedSubscription\":\"e2e-rate-iso-a-ac0f77\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-06T19:49:58Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"929b7f0f-54bf-4403-b2c2-819fa774eaa5","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-5c92ad.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-5c92ad","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-ac0f77","namespace":"ai-tenant-e2e-shared-a-5c92ad","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-06T19:49:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"929b7f0f-54bf-4403-b2c2-819fa774eaa5","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:49:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"929b7f0f-54bf-4403-b2c2-819fa774eaa5","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:49:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"929b7f0f-54bf-4403-b2c2-819fa774eaa5","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:49:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"929b7f0f-54bf-4403-b2c2-819fa774eaa5","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-5c92ad/rate-test-model-5c92ad\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:49:58Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"929b7f0f-54bf-4403-b2c2-819fa774eaa5","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:49:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"929b7f0f-54bf-4403-b2c2-819fa774eaa5","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-06T19:49:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"929b7f0f-54bf-4403-b2c2-819fa774eaa5","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-ac0f77"}
{"level":"debug","ts":"2026-07-06T19:49:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"929b7f0f-54bf-4403-b2c2-819fa774eaa5","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-06T19:49:58Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"929b7f0f-54bf-4403-b2c2-819fa774eaa5","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"868784d8-87ea-49e9-9260-0b1410b7b9ec","keyName":"e2e-rate-a-ac0f77","selected_subscription":"e2e-rate-iso-a-ac0f77","selected_subscription_key":"ai-tenant-e2e-shared-a-5c92ad/e2e-rate-iso-a-ac0f77@ai-tenant-e2e-shared-a-5c92ad/rate-test-model-5c92ad","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-5c92ad","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-ac0f77","namespace":"ai-tenant-e2e-shared-a-5c92ad","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-06T19:49:58Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"929b7f0f-54bf-4403-b2c2-819fa774eaa5","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T19:49:58Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"929b7f0f-54bf-4403-b2c2-819fa774eaa5","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T19:49:59Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"63fb36a4-89ff-4920-9ba5-f49f5fcd5e9c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:50438","PortSpecifier":{"PortValue":50438}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"63fb36a4-89ff-4920-9ba5-f49f5fcd5e9c","method":"POST","path":"/ai-tenant-e2e-shared-a-5c92ad/rate-test-model-5c92ad/v1/completions","host":"e2e-shared-a-5c92ad.apps.ed6006ff-308f-4519-b84f-e305d9418cee.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T19:49:59Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"63fb36a4-89ff-4920-9ba5-f49f5fcd5e9c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:50438","PortSpecifier":{"PortValue":50438}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783367399,"nanos":870959984},"http":{"id":"63fb36a4-89ff-4920-9ba5-f49f5fcd5e9c","method":"POST","headers":{":authority":"e2e-shared-a-5c92ad.apps.ed6006ff-308f-4519-b84f-e305d9418cee.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-5c92ad/rate-test-model-5c92ad/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:49:59Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"63fb36a4-89ff-4920-9ba5-f49f5fcd5e9c","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1IPm5stXCufLhLNOY_4Bp8jymW2H5iBv56ztQtHKtuqSLcHpOSKx4WPkeNJ0H"}
{"level":"debug","ts":"2026-07-06T19:49:59Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"63fb36a4-89ff-4920-9ba5-f49f5fcd5e9c","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-5c92ad.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1IPm5stXCufLhLNOY_4Bp8jymW2H5iBv56ztQtHKtuqSLcHpOSKx4WPkeNJ0H\"}"}
{"level":"debug","ts":"2026-07-06T19:49:59Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"63fb36a4-89ff-4920-9ba5-f49f5fcd5e9c","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-5c92ad.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"868784d8-87ea-49e9-9260-0b1410b7b9ec","keyName":"e2e-rate-a-ac0f77","subscription":"e2e-rate-iso-a-ac0f77","tenant":"e2e-shared-a-5c92ad","userId":"868784d8-87ea-49e9-9260-0b1410b7b9ec","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-06T19:49:59Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"63fb36a4-89ff-4920-9ba5-f49f5fcd5e9c","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-5c92ad.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-5c92ad/rate-test-model-5c92ad\",\"requestedSubscription\":\"e2e-rate-iso-a-ac0f77\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-06T19:49:59Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"63fb36a4-89ff-4920-9ba5-f49f5fcd5e9c","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-5c92ad.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-5c92ad","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-ac0f77","namespace":"ai-tenant-e2e-shared-a-5c92ad","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-06T19:49:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"63fb36a4-89ff-4920-9ba5-f49f5fcd5e9c","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:49:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"63fb36a4-89ff-4920-9ba5-f49f5fcd5e9c","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:49:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"63fb36a4-89ff-4920-9ba5-f49f5fcd5e9c","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:49:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"63fb36a4-89ff-4920-9ba5-f49f5fcd5e9c","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-5c92ad/rate-test-model-5c92ad\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:49:59Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"63fb36a4-89ff-4920-9ba5-f49f5fcd5e9c","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:49:59Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"63fb36a4-89ff-4920-9ba5-f49f5fcd5e9c","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-06T19:49:59Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"63fb36a4-89ff-4920-9ba5-f49f5fcd5e9c","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-ac0f77"}
{"level":"debug","ts":"2026-07-06T19:49:59Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"63fb36a4-89ff-4920-9ba5-f49f5fcd5e9c","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-06T19:49:59Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"63fb36a4-89ff-4920-9ba5-f49f5fcd5e9c","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"868784d8-87ea-49e9-9260-0b1410b7b9ec","keyName":"e2e-rate-a-ac0f77","selected_subscription":"e2e-rate-iso-a-ac0f77","selected_subscription_key":"ai-tenant-e2e-shared-a-5c92ad/e2e-rate-iso-a-ac0f77@ai-tenant-e2e-shared-a-5c92ad/rate-test-model-5c92ad","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-5c92ad","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-ac0f77","namespace":"ai-tenant-e2e-shared-a-5c92ad","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-06T19:49:59Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"63fb36a4-89ff-4920-9ba5-f49f5fcd5e9c","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T19:49:59Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"63fb36a4-89ff-4920-9ba5-f49f5fcd5e9c","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T19:50:00Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c82b53dd-8287-4edb-ab93-d9b65067cd77","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:50450","PortSpecifier":{"PortValue":50450}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"c82b53dd-8287-4edb-ab93-d9b65067cd77","method":"POST","path":"/ai-tenant-e2e-shared-a-5c92ad/rate-test-model-5c92ad/v1/completions","host":"e2e-shared-a-5c92ad.apps.ed6006ff-308f-4519-b84f-e305d9418cee.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T19:50:00Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c82b53dd-8287-4edb-ab93-d9b65067cd77","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:50450","PortSpecifier":{"PortValue":50450}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783367400,"nanos":903160719},"http":{"id":"c82b53dd-8287-4edb-ab93-d9b65067cd77","method":"POST","headers":{":authority":"e2e-shared-a-5c92ad.apps.ed6006ff-308f-4519-b84f-e305d9418cee.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-5c92ad/rate-test-model-5c92ad/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:50:00Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"c82b53dd-8287-4edb-ab93-d9b65067cd77","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1IPm5stXCufLhLNOY_4Bp8jymW2H5iBv56ztQtHKtuqSLcHpOSKx4WPkeNJ0H"}
{"level":"debug","ts":"2026-07-06T19:50:00Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"c82b53dd-8287-4edb-ab93-d9b65067cd77","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-5c92ad.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1IPm5stXCufLhLNOY_4Bp8jymW2H5iBv56ztQtHKtuqSLcHpOSKx4WPkeNJ0H\"}"}
{"level":"debug","ts":"2026-07-06T19:50:00Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"c82b53dd-8287-4edb-ab93-d9b65067cd77","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-5c92ad.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"868784d8-87ea-49e9-9260-0b1410b7b9ec","keyName":"e2e-rate-a-ac0f77","subscription":"e2e-rate-iso-a-ac0f77","tenant":"e2e-shared-a-5c92ad","userId":"868784d8-87ea-49e9-9260-0b1410b7b9ec","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-06T19:50:00Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"c82b53dd-8287-4edb-ab93-d9b65067cd77","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-5c92ad.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-5c92ad/rate-test-model-5c92ad\",\"requestedSubscription\":\"e2e-rate-iso-a-ac0f77\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-06T19:50:00Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"c82b53dd-8287-4edb-ab93-d9b65067cd77","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-5c92ad.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-5c92ad","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-ac0f77","namespace":"ai-tenant-e2e-shared-a-5c92ad","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-06T19:50:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"c82b53dd-8287-4edb-ab93-d9b65067cd77","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:50:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c82b53dd-8287-4edb-ab93-d9b65067cd77","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:50:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c82b53dd-8287-4edb-ab93-d9b65067cd77","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:50:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c82b53dd-8287-4edb-ab93-d9b65067cd77","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-5c92ad/rate-test-model-5c92ad\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:50:00Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c82b53dd-8287-4edb-ab93-d9b65067cd77","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:50:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c82b53dd-8287-4edb-ab93-d9b65067cd77","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-06T19:50:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c82b53dd-8287-4edb-ab93-d9b65067cd77","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-06T19:50:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c82b53dd-8287-4edb-ab93-d9b65067cd77","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-ac0f77"}
{"level":"debug","ts":"2026-07-06T19:50:00Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c82b53dd-8287-4edb-ab93-d9b65067cd77","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"868784d8-87ea-49e9-9260-0b1410b7b9ec","keyName":"e2e-rate-a-ac0f77","selected_subscription":"e2e-rate-iso-a-ac0f77","selected_subscription_key":"ai-tenant-e2e-shared-a-5c92ad/e2e-rate-iso-a-ac0f77@ai-tenant-e2e-shared-a-5c92ad/rate-test-model-5c92ad","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-5c92ad","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-ac0f77","namespace":"ai-tenant-e2e-shared-a-5c92ad","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-06T19:50:00Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c82b53dd-8287-4edb-ab93-d9b65067cd77","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T19:50:00Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c82b53dd-8287-4edb-ab93-d9b65067cd77","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T19:50:01Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6cf61798-68dc-4f02-b577-4b0586538fca","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:50452","PortSpecifier":{"PortValue":50452}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"6cf61798-68dc-4f02-b577-4b0586538fca","method":"POST","path":"/ai-tenant-e2e-shared-a-5c92ad/rate-test-model-5c92ad/v1/completions","host":"e2e-shared-a-5c92ad.apps.ed6006ff-308f-4519-b84f-e305d9418cee.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T19:50:01Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6cf61798-68dc-4f02-b577-4b0586538fca","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:50452","PortSpecifier":{"PortValue":50452}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783367401,"nanos":944904564},"http":{"id":"6cf61798-68dc-4f02-b577-4b0586538fca","method":"POST","headers":{":authority":"e2e-shared-a-5c92ad.apps.ed6006ff-308f-4519-b84f-e305d9418cee.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-5c92ad/rate-test-model-5c92ad/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:50:01Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"6cf61798-68dc-4f02-b577-4b0586538fca","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1IPm5stXCufLhLNOY_4Bp8jymW2H5iBv56ztQtHKtuqSLcHpOSKx4WPkeNJ0H"}
{"level":"debug","ts":"2026-07-06T19:50:01Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"6cf61798-68dc-4f02-b577-4b0586538fca","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-5c92ad.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1IPm5stXCufLhLNOY_4Bp8jymW2H5iBv56ztQtHKtuqSLcHpOSKx4WPkeNJ0H\"}"}
{"level":"debug","ts":"2026-07-06T19:50:01Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"6cf61798-68dc-4f02-b577-4b0586538fca","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-5c92ad.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"868784d8-87ea-49e9-9260-0b1410b7b9ec","keyName":"e2e-rate-a-ac0f77","subscription":"e2e-rate-iso-a-ac0f77","tenant":"e2e-shared-a-5c92ad","userId":"868784d8-87ea-49e9-9260-0b1410b7b9ec","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-06T19:50:01Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"6cf61798-68dc-4f02-b577-4b0586538fca","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-5c92ad.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-5c92ad/rate-test-model-5c92ad\",\"requestedSubscription\":\"e2e-rate-iso-a-ac0f77\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-06T19:50:01Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"6cf61798-68dc-4f02-b577-4b0586538fca","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-5c92ad.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-5c92ad","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-ac0f77","namespace":"ai-tenant-e2e-shared-a-5c92ad","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-06T19:50:01Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"6cf61798-68dc-4f02-b577-4b0586538fca","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:50:01Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6cf61798-68dc-4f02-b577-4b0586538fca","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:50:01Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6cf61798-68dc-4f02-b577-4b0586538fca","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:50:01Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6cf61798-68dc-4f02-b577-4b0586538fca","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-5c92ad/rate-test-model-5c92ad\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:50:01Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6cf61798-68dc-4f02-b577-4b0586538fca","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:50:01Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6cf61798-68dc-4f02-b577-4b0586538fca","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-ac0f77"}
{"level":"debug","ts":"2026-07-06T19:50:01Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6cf61798-68dc-4f02-b577-4b0586538fca","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-06T19:50:01Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6cf61798-68dc-4f02-b577-4b0586538fca","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-06T19:50:01Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6cf61798-68dc-4f02-b577-4b0586538fca","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"868784d8-87ea-49e9-9260-0b1410b7b9ec","keyName":"e2e-rate-a-ac0f77","selected_subscription":"e2e-rate-iso-a-ac0f77","selected_subscription_key":"ai-tenant-e2e-shared-a-5c92ad/e2e-rate-iso-a-ac0f77@ai-tenant-e2e-shared-a-5c92ad/rate-test-model-5c92ad","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-5c92ad","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-ac0f77","namespace":"ai-tenant-e2e-shared-a-5c92ad","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-06T19:50:01Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6cf61798-68dc-4f02-b577-4b0586538fca","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T19:50:01Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6cf61798-68dc-4f02-b577-4b0586538fca","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T19:50:03Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"876e3291-73c0-4111-82d4-69f8b49df7c9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:50456","PortSpecifier":{"PortValue":50456}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"876e3291-73c0-4111-82d4-69f8b49df7c9","method":"POST","path":"/ai-tenant-e2e-shared-a-5c92ad/rate-test-model-5c92ad/v1/completions","host":"e2e-shared-a-5c92ad.apps.ed6006ff-308f-4519-b84f-e305d9418cee.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T19:50:03Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"876e3291-73c0-4111-82d4-69f8b49df7c9","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:50456","PortSpecifier":{"PortValue":50456}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783367403,"nanos":8815905},"http":{"id":"876e3291-73c0-4111-82d4-69f8b49df7c9","method":"POST","headers":{":authority":"e2e-shared-a-5c92ad.apps.ed6006ff-308f-4519-b84f-e305d9418cee.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-5c92ad/rate-test-model-5c92ad/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:50:03Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"876e3291-73c0-4111-82d4-69f8b49df7c9","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1IPm5stXCufLhLNOY_4Bp8jymW2H5iBv56ztQtHKtuqSLcHpOSKx4WPkeNJ0H"}
{"level":"debug","ts":"2026-07-06T19:50:03Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"876e3291-73c0-4111-82d4-69f8b49df7c9","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-5c92ad.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1IPm5stXCufLhLNOY_4Bp8jymW2H5iBv56ztQtHKtuqSLcHpOSKx4WPkeNJ0H\"}"}
{"level":"debug","ts":"2026-07-06T19:50:03Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"876e3291-73c0-4111-82d4-69f8b49df7c9","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-5c92ad.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"868784d8-87ea-49e9-9260-0b1410b7b9ec","keyName":"e2e-rate-a-ac0f77","subscription":"e2e-rate-iso-a-ac0f77","tenant":"e2e-shared-a-5c92ad","userId":"868784d8-87ea-49e9-9260-0b1410b7b9ec","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-06T19:50:03Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"876e3291-73c0-4111-82d4-69f8b49df7c9","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-5c92ad.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-5c92ad/rate-test-model-5c92ad\",\"requestedSubscription\":\"e2e-rate-iso-a-ac0f77\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-06T19:50:03Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"876e3291-73c0-4111-82d4-69f8b49df7c9","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-5c92ad.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-5c92ad","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-ac0f77","namespace":"ai-tenant-e2e-shared-a-5c92ad","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-06T19:50:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"876e3291-73c0-4111-82d4-69f8b49df7c9","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:50:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"876e3291-73c0-4111-82d4-69f8b49df7c9","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:50:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"876e3291-73c0-4111-82d4-69f8b49df7c9","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:50:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"876e3291-73c0-4111-82d4-69f8b49df7c9","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-5c92ad/rate-test-model-5c92ad\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:50:03Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"876e3291-73c0-4111-82d4-69f8b49df7c9","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:50:03Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"876e3291-73c0-4111-82d4-69f8b49df7c9","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-06T19:50:03Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"876e3291-73c0-4111-82d4-69f8b49df7c9","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-ac0f77"}
{"level":"debug","ts":"2026-07-06T19:50:03Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"876e3291-73c0-4111-82d4-69f8b49df7c9","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-06T19:50:03Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"876e3291-73c0-4111-82d4-69f8b49df7c9","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"868784d8-87ea-49e9-9260-0b1410b7b9ec","keyName":"e2e-rate-a-ac0f77","selected_subscription":"e2e-rate-iso-a-ac0f77","selected_subscription_key":"ai-tenant-e2e-shared-a-5c92ad/e2e-rate-iso-a-ac0f77@ai-tenant-e2e-shared-a-5c92ad/rate-test-model-5c92ad","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-5c92ad","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-ac0f77","namespace":"ai-tenant-e2e-shared-a-5c92ad","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-06T19:50:03Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"876e3291-73c0-4111-82d4-69f8b49df7c9","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T19:50:03Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"876e3291-73c0-4111-82d4-69f8b49df7c9","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T19:50:04Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8b5e6f23-88ea-4a89-9604-ffcee0ccff2f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:50460","PortSpecifier":{"PortValue":50460}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"8b5e6f23-88ea-4a89-9604-ffcee0ccff2f","method":"POST","path":"/ai-tenant-e2e-shared-a-5c92ad/rate-test-model-5c92ad/v1/completions","host":"e2e-shared-a-5c92ad.apps.ed6006ff-308f-4519-b84f-e305d9418cee.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T19:50:04Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8b5e6f23-88ea-4a89-9604-ffcee0ccff2f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:50460","PortSpecifier":{"PortValue":50460}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783367404,"nanos":50172112},"http":{"id":"8b5e6f23-88ea-4a89-9604-ffcee0ccff2f","method":"POST","headers":{":authority":"e2e-shared-a-5c92ad.apps.ed6006ff-308f-4519-b84f-e305d9418cee.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-5c92ad/rate-test-model-5c92ad/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:50:04Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"8b5e6f23-88ea-4a89-9604-ffcee0ccff2f","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1IPm5stXCufLhLNOY_4Bp8jymW2H5iBv56ztQtHKtuqSLcHpOSKx4WPkeNJ0H"}
{"level":"debug","ts":"2026-07-06T19:50:04Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"8b5e6f23-88ea-4a89-9604-ffcee0ccff2f","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-5c92ad.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1IPm5stXCufLhLNOY_4Bp8jymW2H5iBv56ztQtHKtuqSLcHpOSKx4WPkeNJ0H\"}"}
{"level":"debug","ts":"2026-07-06T19:50:04Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"8b5e6f23-88ea-4a89-9604-ffcee0ccff2f","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-5c92ad.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"868784d8-87ea-49e9-9260-0b1410b7b9ec","keyName":"e2e-rate-a-ac0f77","subscription":"e2e-rate-iso-a-ac0f77","tenant":"e2e-shared-a-5c92ad","userId":"868784d8-87ea-49e9-9260-0b1410b7b9ec","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-06T19:50:04Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"8b5e6f23-88ea-4a89-9604-ffcee0ccff2f","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-5c92ad.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-5c92ad/rate-test-model-5c92ad\",\"requestedSubscription\":\"e2e-rate-iso-a-ac0f77\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-06T19:50:04Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"8b5e6f23-88ea-4a89-9604-ffcee0ccff2f","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-5c92ad.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-5c92ad","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-ac0f77","namespace":"ai-tenant-e2e-shared-a-5c92ad","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-06T19:50:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"8b5e6f23-88ea-4a89-9604-ffcee0ccff2f","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:50:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8b5e6f23-88ea-4a89-9604-ffcee0ccff2f","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:50:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8b5e6f23-88ea-4a89-9604-ffcee0ccff2f","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:50:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8b5e6f23-88ea-4a89-9604-ffcee0ccff2f","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-5c92ad/rate-test-model-5c92ad\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:50:04Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8b5e6f23-88ea-4a89-9604-ffcee0ccff2f","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:50:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8b5e6f23-88ea-4a89-9604-ffcee0ccff2f","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-ac0f77"}
{"level":"debug","ts":"2026-07-06T19:50:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8b5e6f23-88ea-4a89-9604-ffcee0ccff2f","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-06T19:50:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8b5e6f23-88ea-4a89-9604-ffcee0ccff2f","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-06T19:50:04Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8b5e6f23-88ea-4a89-9604-ffcee0ccff2f","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"868784d8-87ea-49e9-9260-0b1410b7b9ec","keyName":"e2e-rate-a-ac0f77","selected_subscription":"e2e-rate-iso-a-ac0f77","selected_subscription_key":"ai-tenant-e2e-shared-a-5c92ad/e2e-rate-iso-a-ac0f77@ai-tenant-e2e-shared-a-5c92ad/rate-test-model-5c92ad","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-5c92ad","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-ac0f77","namespace":"ai-tenant-e2e-shared-a-5c92ad","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-06T19:50:04Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8b5e6f23-88ea-4a89-9604-ffcee0ccff2f","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T19:50:04Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8b5e6f23-88ea-4a89-9604-ffcee0ccff2f","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T19:50:05Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c60d1c09-a4a4-4001-ad15-9b10a2d657b7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:50474","PortSpecifier":{"PortValue":50474}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"c60d1c09-a4a4-4001-ad15-9b10a2d657b7","method":"POST","path":"/ai-tenant-e2e-shared-a-5c92ad/rate-test-model-5c92ad/v1/completions","host":"e2e-shared-a-5c92ad.apps.ed6006ff-308f-4519-b84f-e305d9418cee.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T19:50:05Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c60d1c09-a4a4-4001-ad15-9b10a2d657b7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:50474","PortSpecifier":{"PortValue":50474}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783367405,"nanos":81910197},"http":{"id":"c60d1c09-a4a4-4001-ad15-9b10a2d657b7","method":"POST","headers":{":authority":"e2e-shared-a-5c92ad.apps.ed6006ff-308f-4519-b84f-e305d9418cee.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-5c92ad/rate-test-model-5c92ad/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:50:05Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"c60d1c09-a4a4-4001-ad15-9b10a2d657b7","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1IPm5stXCufLhLNOY_4Bp8jymW2H5iBv56ztQtHKtuqSLcHpOSKx4WPkeNJ0H"}
{"level":"debug","ts":"2026-07-06T19:50:05Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"c60d1c09-a4a4-4001-ad15-9b10a2d657b7","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-5c92ad.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1IPm5stXCufLhLNOY_4Bp8jymW2H5iBv56ztQtHKtuqSLcHpOSKx4WPkeNJ0H\"}"}
{"level":"debug","ts":"2026-07-06T19:50:05Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"c60d1c09-a4a4-4001-ad15-9b10a2d657b7","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-5c92ad.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"868784d8-87ea-49e9-9260-0b1410b7b9ec","keyName":"e2e-rate-a-ac0f77","subscription":"e2e-rate-iso-a-ac0f77","tenant":"e2e-shared-a-5c92ad","userId":"868784d8-87ea-49e9-9260-0b1410b7b9ec","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-06T19:50:05Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"c60d1c09-a4a4-4001-ad15-9b10a2d657b7","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-5c92ad.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-5c92ad/rate-test-model-5c92ad\",\"requestedSubscription\":\"e2e-rate-iso-a-ac0f77\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-06T19:50:05Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"c60d1c09-a4a4-4001-ad15-9b10a2d657b7","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-5c92ad.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-5c92ad","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-ac0f77","namespace":"ai-tenant-e2e-shared-a-5c92ad","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-06T19:50:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"c60d1c09-a4a4-4001-ad15-9b10a2d657b7","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:50:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c60d1c09-a4a4-4001-ad15-9b10a2d657b7","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:50:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c60d1c09-a4a4-4001-ad15-9b10a2d657b7","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:50:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c60d1c09-a4a4-4001-ad15-9b10a2d657b7","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-5c92ad/rate-test-model-5c92ad\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:50:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c60d1c09-a4a4-4001-ad15-9b10a2d657b7","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:50:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c60d1c09-a4a4-4001-ad15-9b10a2d657b7","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-06T19:50:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c60d1c09-a4a4-4001-ad15-9b10a2d657b7","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-06T19:50:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c60d1c09-a4a4-4001-ad15-9b10a2d657b7","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-ac0f77"}
{"level":"debug","ts":"2026-07-06T19:50:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c60d1c09-a4a4-4001-ad15-9b10a2d657b7","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"868784d8-87ea-49e9-9260-0b1410b7b9ec","keyName":"e2e-rate-a-ac0f77","selected_subscription":"e2e-rate-iso-a-ac0f77","selected_subscription_key":"ai-tenant-e2e-shared-a-5c92ad/e2e-rate-iso-a-ac0f77@ai-tenant-e2e-shared-a-5c92ad/rate-test-model-5c92ad","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-5c92ad","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-ac0f77","namespace":"ai-tenant-e2e-shared-a-5c92ad","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-06T19:50:05Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c60d1c09-a4a4-4001-ad15-9b10a2d657b7","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T19:50:05Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c60d1c09-a4a4-4001-ad15-9b10a2d657b7","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T19:50:06Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3d1cf9b3-3f07-44aa-877a-84c0e0dc95af","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:32916","PortSpecifier":{"PortValue":32916}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"3d1cf9b3-3f07-44aa-877a-84c0e0dc95af","method":"POST","path":"/ai-tenant-e2e-shared-a-5c92ad/rate-test-model-5c92ad/v1/completions","host":"e2e-shared-a-5c92ad.apps.ed6006ff-308f-4519-b84f-e305d9418cee.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T19:50:06Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3d1cf9b3-3f07-44aa-877a-84c0e0dc95af","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:32916","PortSpecifier":{"PortValue":32916}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783367406,"nanos":118192035},"http":{"id":"3d1cf9b3-3f07-44aa-877a-84c0e0dc95af","method":"POST","headers":{":authority":"e2e-shared-a-5c92ad.apps.ed6006ff-308f-4519-b84f-e305d9418cee.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-5c92ad/rate-test-model-5c92ad/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:50:06Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"3d1cf9b3-3f07-44aa-877a-84c0e0dc95af","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1IPm5stXCufLhLNOY_4Bp8jymW2H5iBv56ztQtHKtuqSLcHpOSKx4WPkeNJ0H"}
{"level":"debug","ts":"2026-07-06T19:50:06Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"3d1cf9b3-3f07-44aa-877a-84c0e0dc95af","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-5c92ad.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1IPm5stXCufLhLNOY_4Bp8jymW2H5iBv56ztQtHKtuqSLcHpOSKx4WPkeNJ0H\"}"}
{"level":"debug","ts":"2026-07-06T19:50:06Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"3d1cf9b3-3f07-44aa-877a-84c0e0dc95af","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-5c92ad.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"868784d8-87ea-49e9-9260-0b1410b7b9ec","keyName":"e2e-rate-a-ac0f77","subscription":"e2e-rate-iso-a-ac0f77","tenant":"e2e-shared-a-5c92ad","userId":"868784d8-87ea-49e9-9260-0b1410b7b9ec","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-06T19:50:06Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"3d1cf9b3-3f07-44aa-877a-84c0e0dc95af","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-5c92ad.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-5c92ad/rate-test-model-5c92ad\",\"requestedSubscription\":\"e2e-rate-iso-a-ac0f77\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-06T19:50:06Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"3d1cf9b3-3f07-44aa-877a-84c0e0dc95af","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-5c92ad.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-5c92ad","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-ac0f77","namespace":"ai-tenant-e2e-shared-a-5c92ad","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-06T19:50:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"3d1cf9b3-3f07-44aa-877a-84c0e0dc95af","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:50:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3d1cf9b3-3f07-44aa-877a-84c0e0dc95af","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:50:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3d1cf9b3-3f07-44aa-877a-84c0e0dc95af","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:50:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3d1cf9b3-3f07-44aa-877a-84c0e0dc95af","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-5c92ad/rate-test-model-5c92ad\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:50:06Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3d1cf9b3-3f07-44aa-877a-84c0e0dc95af","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:50:06Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3d1cf9b3-3f07-44aa-877a-84c0e0dc95af","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-06T19:50:06Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3d1cf9b3-3f07-44aa-877a-84c0e0dc95af","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-ac0f77"}
{"level":"debug","ts":"2026-07-06T19:50:06Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3d1cf9b3-3f07-44aa-877a-84c0e0dc95af","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-06T19:50:06Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3d1cf9b3-3f07-44aa-877a-84c0e0dc95af","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"868784d8-87ea-49e9-9260-0b1410b7b9ec","keyName":"e2e-rate-a-ac0f77","selected_subscription":"e2e-rate-iso-a-ac0f77","selected_subscription_key":"ai-tenant-e2e-shared-a-5c92ad/e2e-rate-iso-a-ac0f77@ai-tenant-e2e-shared-a-5c92ad/rate-test-model-5c92ad","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-5c92ad","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-ac0f77","namespace":"ai-tenant-e2e-shared-a-5c92ad","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-06T19:50:06Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3d1cf9b3-3f07-44aa-877a-84c0e0dc95af","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T19:50:06Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3d1cf9b3-3f07-44aa-877a-84c0e0dc95af","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T19:50:07Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"57a4791f-2dc5-4758-b93f-9e22f0d7d93d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:32924","PortSpecifier":{"PortValue":32924}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"57a4791f-2dc5-4758-b93f-9e22f0d7d93d","method":"POST","path":"/ai-tenant-e2e-shared-a-5c92ad/rate-test-model-5c92ad/v1/completions","host":"e2e-shared-a-5c92ad.apps.ed6006ff-308f-4519-b84f-e305d9418cee.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T19:50:07Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"57a4791f-2dc5-4758-b93f-9e22f0d7d93d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:32924","PortSpecifier":{"PortValue":32924}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783367407,"nanos":152535191},"http":{"id":"57a4791f-2dc5-4758-b93f-9e22f0d7d93d","method":"POST","headers":{":authority":"e2e-shared-a-5c92ad.apps.ed6006ff-308f-4519-b84f-e305d9418cee.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-5c92ad/rate-test-model-5c92ad/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:50:07Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"57a4791f-2dc5-4758-b93f-9e22f0d7d93d","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1IPm5stXCufLhLNOY_4Bp8jymW2H5iBv56ztQtHKtuqSLcHpOSKx4WPkeNJ0H"}
{"level":"debug","ts":"2026-07-06T19:50:07Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"57a4791f-2dc5-4758-b93f-9e22f0d7d93d","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-5c92ad.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1IPm5stXCufLhLNOY_4Bp8jymW2H5iBv56ztQtHKtuqSLcHpOSKx4WPkeNJ0H\"}"}
{"level":"debug","ts":"2026-07-06T19:50:07Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"57a4791f-2dc5-4758-b93f-9e22f0d7d93d","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-5c92ad.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"868784d8-87ea-49e9-9260-0b1410b7b9ec","keyName":"e2e-rate-a-ac0f77","subscription":"e2e-rate-iso-a-ac0f77","tenant":"e2e-shared-a-5c92ad","userId":"868784d8-87ea-49e9-9260-0b1410b7b9ec","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-06T19:50:07Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"57a4791f-2dc5-4758-b93f-9e22f0d7d93d","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-5c92ad.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-5c92ad/rate-test-model-5c92ad\",\"requestedSubscription\":\"e2e-rate-iso-a-ac0f77\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-06T19:50:07Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"57a4791f-2dc5-4758-b93f-9e22f0d7d93d","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-5c92ad.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-5c92ad","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-ac0f77","namespace":"ai-tenant-e2e-shared-a-5c92ad","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-06T19:50:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"57a4791f-2dc5-4758-b93f-9e22f0d7d93d","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:50:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"57a4791f-2dc5-4758-b93f-9e22f0d7d93d","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:50:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"57a4791f-2dc5-4758-b93f-9e22f0d7d93d","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:50:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"57a4791f-2dc5-4758-b93f-9e22f0d7d93d","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-5c92ad/rate-test-model-5c92ad\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:50:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"57a4791f-2dc5-4758-b93f-9e22f0d7d93d","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:50:07Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"57a4791f-2dc5-4758-b93f-9e22f0d7d93d","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-06T19:50:07Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"57a4791f-2dc5-4758-b93f-9e22f0d7d93d","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-06T19:50:07Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"57a4791f-2dc5-4758-b93f-9e22f0d7d93d","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-ac0f77"}
{"level":"debug","ts":"2026-07-06T19:50:07Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"57a4791f-2dc5-4758-b93f-9e22f0d7d93d","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"868784d8-87ea-49e9-9260-0b1410b7b9ec","keyName":"e2e-rate-a-ac0f77","selected_subscription":"e2e-rate-iso-a-ac0f77","selected_subscription_key":"ai-tenant-e2e-shared-a-5c92ad/e2e-rate-iso-a-ac0f77@ai-tenant-e2e-shared-a-5c92ad/rate-test-model-5c92ad","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-5c92ad","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-ac0f77","namespace":"ai-tenant-e2e-shared-a-5c92ad","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-06T19:50:07Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"57a4791f-2dc5-4758-b93f-9e22f0d7d93d","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T19:50:07Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"57a4791f-2dc5-4758-b93f-9e22f0d7d93d","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T19:50:08Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"08ff568d-1937-4ce5-870c-cbd90f881ed3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:32926","PortSpecifier":{"PortValue":32926}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"08ff568d-1937-4ce5-870c-cbd90f881ed3","method":"POST","path":"/ai-tenant-e2e-shared-a-5c92ad/rate-test-model-5c92ad/v1/completions","host":"e2e-shared-a-5c92ad.apps.ed6006ff-308f-4519-b84f-e305d9418cee.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T19:50:08Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"08ff568d-1937-4ce5-870c-cbd90f881ed3","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:32926","PortSpecifier":{"PortValue":32926}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783367408,"nanos":185326747},"http":{"id":"08ff568d-1937-4ce5-870c-cbd90f881ed3","method":"POST","headers":{":authority":"e2e-shared-a-5c92ad.apps.ed6006ff-308f-4519-b84f-e305d9418cee.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-5c92ad/rate-test-model-5c92ad/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:50:08Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"08ff568d-1937-4ce5-870c-cbd90f881ed3","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1IPm5stXCufLhLNOY_4Bp8jymW2H5iBv56ztQtHKtuqSLcHpOSKx4WPkeNJ0H"}
{"level":"debug","ts":"2026-07-06T19:50:08Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"08ff568d-1937-4ce5-870c-cbd90f881ed3","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-5c92ad.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1IPm5stXCufLhLNOY_4Bp8jymW2H5iBv56ztQtHKtuqSLcHpOSKx4WPkeNJ0H\"}"}
{"level":"debug","ts":"2026-07-06T19:50:08Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"08ff568d-1937-4ce5-870c-cbd90f881ed3","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-5c92ad.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"868784d8-87ea-49e9-9260-0b1410b7b9ec","keyName":"e2e-rate-a-ac0f77","subscription":"e2e-rate-iso-a-ac0f77","tenant":"e2e-shared-a-5c92ad","userId":"868784d8-87ea-49e9-9260-0b1410b7b9ec","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-06T19:50:08Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"08ff568d-1937-4ce5-870c-cbd90f881ed3","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-5c92ad.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-5c92ad/rate-test-model-5c92ad\",\"requestedSubscription\":\"e2e-rate-iso-a-ac0f77\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-06T19:50:08Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"08ff568d-1937-4ce5-870c-cbd90f881ed3","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-5c92ad.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-5c92ad","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-ac0f77","namespace":"ai-tenant-e2e-shared-a-5c92ad","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-06T19:50:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"08ff568d-1937-4ce5-870c-cbd90f881ed3","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:50:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"08ff568d-1937-4ce5-870c-cbd90f881ed3","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:50:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"08ff568d-1937-4ce5-870c-cbd90f881ed3","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:50:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"08ff568d-1937-4ce5-870c-cbd90f881ed3","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:50:08Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"08ff568d-1937-4ce5-870c-cbd90f881ed3","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-5c92ad/rate-test-model-5c92ad\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:50:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"08ff568d-1937-4ce5-870c-cbd90f881ed3","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-06T19:50:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"08ff568d-1937-4ce5-870c-cbd90f881ed3","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-ac0f77"}
{"level":"debug","ts":"2026-07-06T19:50:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"08ff568d-1937-4ce5-870c-cbd90f881ed3","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-06T19:50:08Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"08ff568d-1937-4ce5-870c-cbd90f881ed3","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"868784d8-87ea-49e9-9260-0b1410b7b9ec","keyName":"e2e-rate-a-ac0f77","selected_subscription":"e2e-rate-iso-a-ac0f77","selected_subscription_key":"ai-tenant-e2e-shared-a-5c92ad/e2e-rate-iso-a-ac0f77@ai-tenant-e2e-shared-a-5c92ad/rate-test-model-5c92ad","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-5c92ad","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-ac0f77","namespace":"ai-tenant-e2e-shared-a-5c92ad","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-06T19:50:08Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"08ff568d-1937-4ce5-870c-cbd90f881ed3","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T19:50:08Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"08ff568d-1937-4ce5-870c-cbd90f881ed3","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T19:50:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6b77ea1d-6dbe-4017-8a62-66d37b7caf5e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:32930","PortSpecifier":{"PortValue":32930}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"6b77ea1d-6dbe-4017-8a62-66d37b7caf5e","method":"POST","path":"/ai-tenant-e2e-shared-a-5c92ad/rate-test-model-5c92ad/v1/completions","host":"e2e-shared-a-5c92ad.apps.ed6006ff-308f-4519-b84f-e305d9418cee.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T19:50:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"6b77ea1d-6dbe-4017-8a62-66d37b7caf5e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:32930","PortSpecifier":{"PortValue":32930}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.57:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783367409,"nanos":219801918},"http":{"id":"6b77ea1d-6dbe-4017-8a62-66d37b7caf5e","method":"POST","headers":{":authority":"e2e-shared-a-5c92ad.apps.ed6006ff-308f-4519-b84f-e305d9418cee.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-5c92ad/rate-test-model-5c92ad/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:50:09Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"6b77ea1d-6dbe-4017-8a62-66d37b7caf5e","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1IPm5stXCufLhLNOY_4Bp8jymW2H5iBv56ztQtHKtuqSLcHpOSKx4WPkeNJ0H"}
{"level":"debug","ts":"2026-07-06T19:50:09Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"6b77ea1d-6dbe-4017-8a62-66d37b7caf5e","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-5c92ad.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1IPm5stXCufLhLNOY_4Bp8jymW2H5iBv56ztQtHKtuqSLcHpOSKx4WPkeNJ0H\"}"}
{"level":"debug","ts":"2026-07-06T19:50:09Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"6b77ea1d-6dbe-4017-8a62-66d37b7caf5e","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-5c92ad.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"868784d8-87ea-49e9-9260-0b1410b7b9ec","keyName":"e2e-rate-a-ac0f77","subscription":"e2e-rate-iso-a-ac0f77","tenant":"e2e-shared-a-5c92ad","userId":"868784d8-87ea-49e9-9260-0b1410b7b9ec","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-06T19:50:09Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"6b77ea1d-6dbe-4017-8a62-66d37b7caf5e","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-5c92ad.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-5c92ad/rate-test-model-5c92ad\",\"requestedSubscription\":\"e2e-rate-iso-a-ac0f77\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-06T19:50:09Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"6b77ea1d-6dbe-4017-8a62-66d37b7caf5e","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-5c92ad.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-5c92ad","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-ac0f77","namespace":"ai-tenant-e2e-shared-a-5c92ad","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-06T19:50:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"6b77ea1d-6dbe-4017-8a62-66d37b7caf5e","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:50:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6b77ea1d-6dbe-4017-8a62-66d37b7caf5e","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:50:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6b77ea1d-6dbe-4017-8a62-66d37b7caf5e","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:50:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6b77ea1d-6dbe-4017-8a62-66d37b7caf5e","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:50:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"6b77ea1d-6dbe-4017-8a62-66d37b7caf5e","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-5c92ad/rate-test-model-5c92ad\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:50:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6b77ea1d-6dbe-4017-8a62-66d37b7caf5e","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-06T19:50:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6b77ea1d-6dbe-4017-8a62-66d37b7caf5e","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-ac0f77"}
{"level":"debug","ts":"2026-07-06T19:50:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6b77ea1d-6dbe-4017-8a62-66d37b7caf5e","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-06T19:50:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"6b77ea1d-6dbe-4017-8a62-66d37b7caf5e","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"868784d8-87ea-49e9-9260-0b1410b7b9ec","keyName":"e2e-rate-a-ac0f77","selected_subscription":"e2e-rate-iso-a-ac0f77","selected_subscription_key":"ai-tenant-e2e-shared-a-5c92ad/e2e-rate-iso-a-ac0f77@ai-tenant-e2e-shared-a-5c92ad/rate-test-model-5c92ad","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-5c92ad","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-ac0f77","namespace":"ai-tenant-e2e-shared-a-5c92ad","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-06T19:50:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6b77ea1d-6dbe-4017-8a62-66d37b7caf5e","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T19:50:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"6b77ea1d-6dbe-4017-8a62-66d37b7caf5e","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T19:50:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d8fd8cd3-3bbb-48cf-b5ac-446cd1e6a3d0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:39556","PortSpecifier":{"PortValue":39556}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.58:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"d8fd8cd3-3bbb-48cf-b5ac-446cd1e6a3d0","method":"POST","path":"/ai-tenant-e2e-shared-b-5f29b8/rate-test-model-5f29b8/v1/completions","host":"e2e-shared-b-5f29b8.apps.ed6006ff-308f-4519-b84f-e305d9418cee.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-06T19:50:09Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d8fd8cd3-3bbb-48cf-b5ac-446cd1e6a3d0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.9:39556","PortSpecifier":{"PortValue":39556}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.58:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783367409,"nanos":252885751},"http":{"id":"d8fd8cd3-3bbb-48cf-b5ac-446cd1e6a3d0","method":"POST","headers":{":authority":"e2e-shared-b-5f29b8.apps.ed6006ff-308f-4519-b84f-e305d9418cee.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-b-5f29b8/rate-test-model-5f29b8/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:50:09Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"d8fd8cd3-3bbb-48cf-b5ac-446cd1e6a3d0","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-ECO4NS1sx4aWTSFE_AW7uoGevwhXb9CzMWJOe2UAguYCUNBAM15TolUhXicn"}
{"level":"debug","ts":"2026-07-06T19:50:09Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"d8fd8cd3-3bbb-48cf-b5ac-446cd1e6a3d0","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-b-5f29b8.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-ECO4NS1sx4aWTSFE_AW7uoGevwhXb9CzMWJOe2UAguYCUNBAM15TolUhXicn\"}"}
{"level":"debug","ts":"2026-07-06T19:50:09Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"d8fd8cd3-3bbb-48cf-b5ac-446cd1e6a3d0","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-5f29b8.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"2eb2e885-d514-4775-92d8-6462b552cc83","keyName":"e2e-rate-b-ac0f77","subscription":"e2e-rate-iso-b-ac0f77","tenant":"e2e-shared-b-5f29b8","userId":"2eb2e885-d514-4775-92d8-6462b552cc83","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-06T19:50:09Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"d8fd8cd3-3bbb-48cf-b5ac-446cd1e6a3d0","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-b-5f29b8.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-b-5f29b8/rate-test-model-5f29b8\",\"requestedSubscription\":\"e2e-rate-iso-b-ac0f77\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-06T19:50:09Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"d8fd8cd3-3bbb-48cf-b5ac-446cd1e6a3d0","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-5f29b8.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-5f29b8","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-ac0f77","namespace":"ai-tenant-e2e-shared-b-5f29b8","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-06T19:50:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"d8fd8cd3-3bbb-48cf-b5ac-446cd1e6a3d0","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-06T19:50:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d8fd8cd3-3bbb-48cf-b5ac-446cd1e6a3d0","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:50:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d8fd8cd3-3bbb-48cf-b5ac-446cd1e6a3d0","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:50:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d8fd8cd3-3bbb-48cf-b5ac-446cd1e6a3d0","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:50:09Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d8fd8cd3-3bbb-48cf-b5ac-446cd1e6a3d0","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-5f29b8/rate-test-model-5f29b8\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-06T19:50:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d8fd8cd3-3bbb-48cf-b5ac-446cd1e6a3d0","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-06T19:50:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d8fd8cd3-3bbb-48cf-b5ac-446cd1e6a3d0","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-b-ac0f77"}
{"level":"debug","ts":"2026-07-06T19:50:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d8fd8cd3-3bbb-48cf-b5ac-446cd1e6a3d0","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-06T19:50:09Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d8fd8cd3-3bbb-48cf-b5ac-446cd1e6a3d0","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"2eb2e885-d514-4775-92d8-6462b552cc83","keyName":"e2e-rate-b-ac0f77","selected_subscription":"e2e-rate-iso-b-ac0f77","selected_subscription_key":"ai-tenant-e2e-shared-b-5f29b8/e2e-rate-iso-b-ac0f77@ai-tenant-e2e-shared-b-5f29b8/rate-test-model-5f29b8","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-5f29b8","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-ac0f77","namespace":"ai-tenant-e2e-shared-b-5f29b8","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-06T19:50:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d8fd8cd3-3bbb-48cf-b5ac-446cd1e6a3d0","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-06T19:50:09Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d8fd8cd3-3bbb-48cf-b5ac-446cd1e6a3d0","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-06T19:50:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/c365c3d9a7980630c9083c5dc08703bd99785c7155915fd8db92431277ed9512"}
{"level":"info","ts":"2026-07-06T19:50:27Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/cabcfd6a15beec0824b3cd01642f70f9e07fbfa40eef03d3f7727b2c76782ea1"}
{"level":"info","ts":"2026-07-06T19:50:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/2668715d78393fb0ee754250c37d7081631dafabf4dece9db508e1f8297133af"}
{"level":"info","ts":"2026-07-06T19:50:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/9ff6fecce76e8332a1a04ac88654458100199a11cc2c9ed9915aeabc27da476a"}
{"level":"info","ts":"2026-07-06T19:50:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/2ff98491f198b5f467b1debc1b1636888f5de6257a71ba560c8a0e4cd85b5bfa"}
{"level":"info","ts":"2026-07-06T19:50:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/a1abb5c385212313ea35df44e0ce273540a15c31397f9189fed9aa9342896be9"}
{"level":"info","ts":"2026-07-06T19:50:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/d9bb4d1e1800b339ed05edd79cb5704d94bcee43d5427ecce050ce7e380d36b2"}
{"level":"info","ts":"2026-07-06T19:50:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/dd2fe6801aba5bd5aae0ba4297b6e58c1c98b407db4e372040f2acbda32eaa42"}
{"level":"info","ts":"2026-07-06T19:50:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/c1101112b977ccf76c222970c296baf511efad253f2569ee4cc314de8e16b853"}
{"level":"info","ts":"2026-07-06T19:50:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/52658dd5fc2c327e1e4fe7c0c5e3e7caf11950258e3e56c881257cc8467cfef0"}
{"level":"info","ts":"2026-07-06T19:50:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/ddde2515fc690f87930d9d79f7cb4fa4867c5ae04bd8cdb2ea55d9c4b9ee65cc"}
{"level":"info","ts":"2026-07-06T19:50:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/1c5c9e4fa50c8661cb0f2e173115e98c202bbfd1de22c6f3c518e2ab15c9dddb"}
{"level":"info","ts":"2026-07-06T19:50:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/df06657c3e5f45f05d36a5a33f161b6786233f06a4869b0650a2ced94e71b07b"}
{"level":"info","ts":"2026-07-06T19:50:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/f491cb5bbc137bc21b70f0e384f7a5deadea97d54731592581e27b9b267a46ec"}
{"level":"info","ts":"2026-07-06T19:50:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/d2d577288c57fd19d06ca6eada6bc2e6b58f59ea76f3470fe526a5f420d07987"}
{"level":"info","ts":"2026-07-06T19:50:28Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/5b719aefb0e634abddadf32b9c495b9f15f5894ecde38a2feffd0bd0f4144016"}
{"level":"info","ts":"2026-07-06T19:50:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/edee7110ea8a89df5f4b02da22579912199045f81b2d5562018522ac43ec1a2b"}
{"level":"info","ts":"2026-07-06T19:50:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/8120aab7de01a4ecc5198bf575949cc6e9806f4176c2d2757bf3361113830cfd"}
{"level":"info","ts":"2026-07-06T19:50:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/2431f64af2d2d5cb3b519eed5505b2a814ba8d60a8cc6ed41b96863aa22d6d6c"}
{"level":"info","ts":"2026-07-06T19:50:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/f4fe118ce81b8c34ddbb09f04a94961e50905ea523599490dc92c8ab9989bfb8"}
{"level":"info","ts":"2026-07-06T19:51:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/427c0d4c00bfe08378e83a96fcf0b92acae0f899baca774a320076c442cd557d"}
{"level":"info","ts":"2026-07-06T19:51:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/47ed502a92e2e6cf8bd63a3f5767836fe3c1d6c442a9a4d28f12bbf5e4e2356a"}
{"level":"info","ts":"2026-07-06T19:51:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/4f36961e3230713ed3ca2c9967d5fe795173416a85a588ff324075e836af5e0a"}
{"level":"info","ts":"2026-07-06T19:51:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/6dbb08da2531d517aac9433e23ea7ed875454fed3824df7bbff0430b41e5014d"}