{"level":"info","ts":"2026-07-23T12:10:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"26100e9ad5b2570f823a795bf302afa5025042363e08510444f9eb505a6113d3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T12:10:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"26100e9ad5b2570f823a795bf302afa5025042363e08510444f9eb505a6113d3","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-23T12:10:22Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-23T12:10:22Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["26100e9ad5b2570f823a795bf302afa5025042363e08510444f9eb505a6113d3"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T12:10:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"26100e9ad5b2570f823a795bf302afa5025042363e08510444f9eb505a6113d3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T12:10:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"26100e9ad5b2570f823a795bf302afa5025042363e08510444f9eb505a6113d3","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-23T12:10:22Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-23T12:10:22Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["26100e9ad5b2570f823a795bf302afa5025042363e08510444f9eb505a6113d3"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T12:10:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2b9877281f28c945222a79c1aedbc369832226edb79c4e1130297b58a2622863"}
{"level":"error","ts":"2026-07-23T12:10:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"26100e9ad5b2570f823a795bf302afa5025042363e08510444f9eb505a6113d3","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"26100e9ad5b2570f823a795bf302afa5025042363e08510444f9eb505a6113d3\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-23T12:10:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2ffe42d10c53a9ad99e367b0783901287cd745a2cfa2235cbc21d6d71ce348c0","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-23T12:10:22Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-23T12:10:22Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T12:10:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2ffe42d10c53a9ad99e367b0783901287cd745a2cfa2235cbc21d6d71ce348c0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T12:10:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"26100e9ad5b2570f823a795bf302afa5025042363e08510444f9eb505a6113d3","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-23T12:10:22Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-23T12:10:22Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T12:10:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/26100e9ad5b2570f823a795bf302afa5025042363e08510444f9eb505a6113d3"}
{"level":"info","ts":"2026-07-23T12:10:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"26100e9ad5b2570f823a795bf302afa5025042363e08510444f9eb505a6113d3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T12:10:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2ffe42d10c53a9ad99e367b0783901287cd745a2cfa2235cbc21d6d71ce348c0","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-23T12:10:22Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-23T12:10:22Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T12:10:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2ffe42d10c53a9ad99e367b0783901287cd745a2cfa2235cbc21d6d71ce348c0"}
{"level":"info","ts":"2026-07-23T12:10:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2ffe42d10c53a9ad99e367b0783901287cd745a2cfa2235cbc21d6d71ce348c0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T12:10:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"26100e9ad5b2570f823a795bf302afa5025042363e08510444f9eb505a6113d3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T12:10:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2ffe42d10c53a9ad99e367b0783901287cd745a2cfa2235cbc21d6d71ce348c0","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-23T12:10:22Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-23T12:10:22Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["2ffe42d10c53a9ad99e367b0783901287cd745a2cfa2235cbc21d6d71ce348c0"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T12:10:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/26100e9ad5b2570f823a795bf302afa5025042363e08510444f9eb505a6113d3"}
{"level":"info","ts":"2026-07-23T12:10:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2ffe42d10c53a9ad99e367b0783901287cd745a2cfa2235cbc21d6d71ce348c0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T12:10:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2ffe42d10c53a9ad99e367b0783901287cd745a2cfa2235cbc21d6d71ce348c0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T12:10:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2ffe42d10c53a9ad99e367b0783901287cd745a2cfa2235cbc21d6d71ce348c0","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-23T12:10:22Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-23T12:10:22Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T12:10:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2ffe42d10c53a9ad99e367b0783901287cd745a2cfa2235cbc21d6d71ce348c0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T12:10:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"26100e9ad5b2570f823a795bf302afa5025042363e08510444f9eb505a6113d3","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-23T12:10:22Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-23T12:10:22Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["26100e9ad5b2570f823a795bf302afa5025042363e08510444f9eb505a6113d3"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T12:10:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2ffe42d10c53a9ad99e367b0783901287cd745a2cfa2235cbc21d6d71ce348c0"}
{"level":"info","ts":"2026-07-23T12:10:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"26100e9ad5b2570f823a795bf302afa5025042363e08510444f9eb505a6113d3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T12:10:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2ffe42d10c53a9ad99e367b0783901287cd745a2cfa2235cbc21d6d71ce348c0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T12:10:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"26100e9ad5b2570f823a795bf302afa5025042363e08510444f9eb505a6113d3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T12:10:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"141f78c990d0a9647ed2ba27d1aa9957d1944666cb0919d24eae763f41343dfb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-23T12:10:22Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-23T12:10:22Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T12:10:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2ffe42d10c53a9ad99e367b0783901287cd745a2cfa2235cbc21d6d71ce348c0"}
{"level":"info","ts":"2026-07-23T12:10:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"141f78c990d0a9647ed2ba27d1aa9957d1944666cb0919d24eae763f41343dfb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T12:10:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2ffe42d10c53a9ad99e367b0783901287cd745a2cfa2235cbc21d6d71ce348c0","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-23T12:10:22Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-23T12:10:22Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["2ffe42d10c53a9ad99e367b0783901287cd745a2cfa2235cbc21d6d71ce348c0"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T12:10:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2ffe42d10c53a9ad99e367b0783901287cd745a2cfa2235cbc21d6d71ce348c0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T12:10:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"141f78c990d0a9647ed2ba27d1aa9957d1944666cb0919d24eae763f41343dfb","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-23T12:10:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/26100e9ad5b2570f823a795bf302afa5025042363e08510444f9eb505a6113d3"}
{"level":"debug","ts":"2026-07-23T12:10:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2ffe42d10c53a9ad99e367b0783901287cd745a2cfa2235cbc21d6d71ce348c0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T12:10:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"141f78c990d0a9647ed2ba27d1aa9957d1944666cb0919d24eae763f41343dfb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-23T12:10:22Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-23T12:10:22Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T12:10:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"141f78c990d0a9647ed2ba27d1aa9957d1944666cb0919d24eae763f41343dfb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T12:10:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"141f78c990d0a9647ed2ba27d1aa9957d1944666cb0919d24eae763f41343dfb","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-23T12:10:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/141f78c990d0a9647ed2ba27d1aa9957d1944666cb0919d24eae763f41343dfb"}
{"level":"debug","ts":"2026-07-23T12:10:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"141f78c990d0a9647ed2ba27d1aa9957d1944666cb0919d24eae763f41343dfb","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-23T12:10:22Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-23T12:10:22Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["141f78c990d0a9647ed2ba27d1aa9957d1944666cb0919d24eae763f41343dfb"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T12:10:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"141f78c990d0a9647ed2ba27d1aa9957d1944666cb0919d24eae763f41343dfb","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T12:10:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"141f78c990d0a9647ed2ba27d1aa9957d1944666cb0919d24eae763f41343dfb","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-23T12:10:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2ffe42d10c53a9ad99e367b0783901287cd745a2cfa2235cbc21d6d71ce348c0"}
{"level":"info","ts":"2026-07-23T12:10:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/141f78c990d0a9647ed2ba27d1aa9957d1944666cb0919d24eae763f41343dfb"}
{"level":"debug","ts":"2026-07-23T12:10:22Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"18a59432af0e78c9b1bfb912f0ea78438ac44c50732852e647d68ddedd009d6d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-23T12:10:22Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-23T12:10:22Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T12:10:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"18a59432af0e78c9b1bfb912f0ea78438ac44c50732852e647d68ddedd009d6d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T12:10:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"18a59432af0e78c9b1bfb912f0ea78438ac44c50732852e647d68ddedd009d6d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T12:10:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"18a59432af0e78c9b1bfb912f0ea78438ac44c50732852e647d68ddedd009d6d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-23T12:10:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/18a59432af0e78c9b1bfb912f0ea78438ac44c50732852e647d68ddedd009d6d"}
{"level":"debug","ts":"2026-07-23T12:10:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"18a59432af0e78c9b1bfb912f0ea78438ac44c50732852e647d68ddedd009d6d","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-23T12:10:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/18a59432af0e78c9b1bfb912f0ea78438ac44c50732852e647d68ddedd009d6d"}
{"level":"debug","ts":"2026-07-23T12:10:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"18a59432af0e78c9b1bfb912f0ea78438ac44c50732852e647d68ddedd009d6d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-23T12:10:23Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-23T12:10:23Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["18a59432af0e78c9b1bfb912f0ea78438ac44c50732852e647d68ddedd009d6d"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T12:10:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"18a59432af0e78c9b1bfb912f0ea78438ac44c50732852e647d68ddedd009d6d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T12:10:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"18a59432af0e78c9b1bfb912f0ea78438ac44c50732852e647d68ddedd009d6d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-23T12:10:23Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-23T12:10:23Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T12:10:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"18a59432af0e78c9b1bfb912f0ea78438ac44c50732852e647d68ddedd009d6d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T12:10:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b96f5e48c2e9e74de26ddd5fc2213d036716d9c79caefcb587ec76ceee4b7d46","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-23T12:10:23Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-23T12:10:23Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T12:10:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/18a59432af0e78c9b1bfb912f0ea78438ac44c50732852e647d68ddedd009d6d"}
{"level":"info","ts":"2026-07-23T12:10:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b96f5e48c2e9e74de26ddd5fc2213d036716d9c79caefcb587ec76ceee4b7d46","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T12:10:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"18a59432af0e78c9b1bfb912f0ea78438ac44c50732852e647d68ddedd009d6d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-23T12:10:23Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-23T12:10:23Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["18a59432af0e78c9b1bfb912f0ea78438ac44c50732852e647d68ddedd009d6d"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T12:10:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b96f5e48c2e9e74de26ddd5fc2213d036716d9c79caefcb587ec76ceee4b7d46"}
{"level":"info","ts":"2026-07-23T12:10:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"18a59432af0e78c9b1bfb912f0ea78438ac44c50732852e647d68ddedd009d6d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T12:10:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b96f5e48c2e9e74de26ddd5fc2213d036716d9c79caefcb587ec76ceee4b7d46","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-23T12:10:23Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-23T12:10:23Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["b96f5e48c2e9e74de26ddd5fc2213d036716d9c79caefcb587ec76ceee4b7d46"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T12:10:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b96f5e48c2e9e74de26ddd5fc2213d036716d9c79caefcb587ec76ceee4b7d46","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T12:10:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"18a59432af0e78c9b1bfb912f0ea78438ac44c50732852e647d68ddedd009d6d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-23T12:10:23Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-23T12:10:23Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T12:10:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/18a59432af0e78c9b1bfb912f0ea78438ac44c50732852e647d68ddedd009d6d"}
{"level":"info","ts":"2026-07-23T12:10:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"18a59432af0e78c9b1bfb912f0ea78438ac44c50732852e647d68ddedd009d6d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T12:10:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b96f5e48c2e9e74de26ddd5fc2213d036716d9c79caefcb587ec76ceee4b7d46","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-23T12:10:23Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-23T12:10:23Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T12:10:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b96f5e48c2e9e74de26ddd5fc2213d036716d9c79caefcb587ec76ceee4b7d46"}
{"level":"info","ts":"2026-07-23T12:10:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b96f5e48c2e9e74de26ddd5fc2213d036716d9c79caefcb587ec76ceee4b7d46","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T12:10:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"18a59432af0e78c9b1bfb912f0ea78438ac44c50732852e647d68ddedd009d6d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T12:10:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b96f5e48c2e9e74de26ddd5fc2213d036716d9c79caefcb587ec76ceee4b7d46","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-23T12:10:23Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-23T12:10:23Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["b96f5e48c2e9e74de26ddd5fc2213d036716d9c79caefcb587ec76ceee4b7d46"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T12:10:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b96f5e48c2e9e74de26ddd5fc2213d036716d9c79caefcb587ec76ceee4b7d46","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T12:10:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"18a59432af0e78c9b1bfb912f0ea78438ac44c50732852e647d68ddedd009d6d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T12:10:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b96f5e48c2e9e74de26ddd5fc2213d036716d9c79caefcb587ec76ceee4b7d46","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-23T12:10:23Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-23T12:10:23Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["b96f5e48c2e9e74de26ddd5fc2213d036716d9c79caefcb587ec76ceee4b7d46"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T12:10:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/18a59432af0e78c9b1bfb912f0ea78438ac44c50732852e647d68ddedd009d6d"}
{"level":"error","ts":"2026-07-23T12:10:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"b96f5e48c2e9e74de26ddd5fc2213d036716d9c79caefcb587ec76ceee4b7d46","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"b96f5e48c2e9e74de26ddd5fc2213d036716d9c79caefcb587ec76ceee4b7d46\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-23T12:10:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8afc556fbda3c92f1513f8bbca03c47e8e3305fe20b62d6c7b046a1f8fd665f6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-23T12:10:23Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-23T12:10:23Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T12:10:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b96f5e48c2e9e74de26ddd5fc2213d036716d9c79caefcb587ec76ceee4b7d46"}
{"level":"info","ts":"2026-07-23T12:10:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8afc556fbda3c92f1513f8bbca03c47e8e3305fe20b62d6c7b046a1f8fd665f6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T12:10:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b96f5e48c2e9e74de26ddd5fc2213d036716d9c79caefcb587ec76ceee4b7d46","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T12:10:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"18a59432af0e78c9b1bfb912f0ea78438ac44c50732852e647d68ddedd009d6d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-23T12:10:23Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-23T12:10:23Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["18a59432af0e78c9b1bfb912f0ea78438ac44c50732852e647d68ddedd009d6d"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T12:10:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"18a59432af0e78c9b1bfb912f0ea78438ac44c50732852e647d68ddedd009d6d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T12:10:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8afc556fbda3c92f1513f8bbca03c47e8e3305fe20b62d6c7b046a1f8fd665f6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-23T12:10:23Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-23T12:10:23Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T12:10:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8afc556fbda3c92f1513f8bbca03c47e8e3305fe20b62d6c7b046a1f8fd665f6"}
{"level":"info","ts":"2026-07-23T12:10:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8afc556fbda3c92f1513f8bbca03c47e8e3305fe20b62d6c7b046a1f8fd665f6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T12:10:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"18a59432af0e78c9b1bfb912f0ea78438ac44c50732852e647d68ddedd009d6d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-23T12:10:23Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-23T12:10:23Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T12:10:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/18a59432af0e78c9b1bfb912f0ea78438ac44c50732852e647d68ddedd009d6d"}
{"level":"info","ts":"2026-07-23T12:10:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"18a59432af0e78c9b1bfb912f0ea78438ac44c50732852e647d68ddedd009d6d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T12:10:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8afc556fbda3c92f1513f8bbca03c47e8e3305fe20b62d6c7b046a1f8fd665f6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T12:10:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"18a59432af0e78c9b1bfb912f0ea78438ac44c50732852e647d68ddedd009d6d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-23T12:10:23Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-23T12:10:23Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["18a59432af0e78c9b1bfb912f0ea78438ac44c50732852e647d68ddedd009d6d"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T12:10:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"18a59432af0e78c9b1bfb912f0ea78438ac44c50732852e647d68ddedd009d6d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T12:10:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"18a59432af0e78c9b1bfb912f0ea78438ac44c50732852e647d68ddedd009d6d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-23T12:10:23Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-23T12:10:23Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["18a59432af0e78c9b1bfb912f0ea78438ac44c50732852e647d68ddedd009d6d"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T12:10:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8afc556fbda3c92f1513f8bbca03c47e8e3305fe20b62d6c7b046a1f8fd665f6"}
{"level":"error","ts":"2026-07-23T12:10:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"18a59432af0e78c9b1bfb912f0ea78438ac44c50732852e647d68ddedd009d6d","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"18a59432af0e78c9b1bfb912f0ea78438ac44c50732852e647d68ddedd009d6d\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-23T12:10:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8afc556fbda3c92f1513f8bbca03c47e8e3305fe20b62d6c7b046a1f8fd665f6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-23T12:10:23Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-23T12:10:23Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["8afc556fbda3c92f1513f8bbca03c47e8e3305fe20b62d6c7b046a1f8fd665f6"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T12:10:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8afc556fbda3c92f1513f8bbca03c47e8e3305fe20b62d6c7b046a1f8fd665f6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T12:10:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"18a59432af0e78c9b1bfb912f0ea78438ac44c50732852e647d68ddedd009d6d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-23T12:10:23Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-23T12:10:23Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T12:10:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/18a59432af0e78c9b1bfb912f0ea78438ac44c50732852e647d68ddedd009d6d"}
{"level":"info","ts":"2026-07-23T12:10:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"18a59432af0e78c9b1bfb912f0ea78438ac44c50732852e647d68ddedd009d6d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T12:10:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"310669938e8914e6285c9258ffb04edc82d93bd0a25facea679f834967b7fb6c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-23T12:10:23Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-23T12:10:23Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T12:10:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/310669938e8914e6285c9258ffb04edc82d93bd0a25facea679f834967b7fb6c"}
{"level":"info","ts":"2026-07-23T12:10:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"310669938e8914e6285c9258ffb04edc82d93bd0a25facea679f834967b7fb6c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T12:10:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8afc556fbda3c92f1513f8bbca03c47e8e3305fe20b62d6c7b046a1f8fd665f6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-23T12:10:23Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-23T12:10:23Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T12:10:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8afc556fbda3c92f1513f8bbca03c47e8e3305fe20b62d6c7b046a1f8fd665f6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T12:10:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"18a59432af0e78c9b1bfb912f0ea78438ac44c50732852e647d68ddedd009d6d","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-23T12:10:23Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-23T12:10:23Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["18a59432af0e78c9b1bfb912f0ea78438ac44c50732852e647d68ddedd009d6d"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T12:10:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8afc556fbda3c92f1513f8bbca03c47e8e3305fe20b62d6c7b046a1f8fd665f6"}
{"level":"info","ts":"2026-07-23T12:10:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"18a59432af0e78c9b1bfb912f0ea78438ac44c50732852e647d68ddedd009d6d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T12:10:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"310669938e8914e6285c9258ffb04edc82d93bd0a25facea679f834967b7fb6c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-23T12:10:23Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-23T12:10:23Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["310669938e8914e6285c9258ffb04edc82d93bd0a25facea679f834967b7fb6c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T12:10:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/18a59432af0e78c9b1bfb912f0ea78438ac44c50732852e647d68ddedd009d6d"}
{"level":"info","ts":"2026-07-23T12:10:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"310669938e8914e6285c9258ffb04edc82d93bd0a25facea679f834967b7fb6c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T12:10:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8afc556fbda3c92f1513f8bbca03c47e8e3305fe20b62d6c7b046a1f8fd665f6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-23T12:10:23Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-23T12:10:23Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["8afc556fbda3c92f1513f8bbca03c47e8e3305fe20b62d6c7b046a1f8fd665f6"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T12:10:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8afc556fbda3c92f1513f8bbca03c47e8e3305fe20b62d6c7b046a1f8fd665f6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T12:10:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"18a59432af0e78c9b1bfb912f0ea78438ac44c50732852e647d68ddedd009d6d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T12:10:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"310669938e8914e6285c9258ffb04edc82d93bd0a25facea679f834967b7fb6c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-23T12:10:23Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-23T12:10:23Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T12:10:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/310669938e8914e6285c9258ffb04edc82d93bd0a25facea679f834967b7fb6c"}
{"level":"info","ts":"2026-07-23T12:10:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"310669938e8914e6285c9258ffb04edc82d93bd0a25facea679f834967b7fb6c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T12:10:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8afc556fbda3c92f1513f8bbca03c47e8e3305fe20b62d6c7b046a1f8fd665f6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-23T12:10:23Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-23T12:10:23Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T12:10:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8afc556fbda3c92f1513f8bbca03c47e8e3305fe20b62d6c7b046a1f8fd665f6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T12:10:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"91ff65466604b48b00e17894964b591a2864ec656863d631725c2ba55b7edbf7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-23T12:10:23Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-23T12:10:23Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T12:10:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8afc556fbda3c92f1513f8bbca03c47e8e3305fe20b62d6c7b046a1f8fd665f6"}
{"level":"info","ts":"2026-07-23T12:10:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/18a59432af0e78c9b1bfb912f0ea78438ac44c50732852e647d68ddedd009d6d"}
{"level":"info","ts":"2026-07-23T12:10:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"91ff65466604b48b00e17894964b591a2864ec656863d631725c2ba55b7edbf7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T12:10:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"310669938e8914e6285c9258ffb04edc82d93bd0a25facea679f834967b7fb6c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-23T12:10:23Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-23T12:10:23Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["310669938e8914e6285c9258ffb04edc82d93bd0a25facea679f834967b7fb6c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T12:10:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/91ff65466604b48b00e17894964b591a2864ec656863d631725c2ba55b7edbf7"}
{"level":"info","ts":"2026-07-23T12:10:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/310669938e8914e6285c9258ffb04edc82d93bd0a25facea679f834967b7fb6c"}
{"level":"info","ts":"2026-07-23T12:10:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8afc556fbda3c92f1513f8bbca03c47e8e3305fe20b62d6c7b046a1f8fd665f6"}
{"level":"info","ts":"2026-07-23T12:10:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"310669938e8914e6285c9258ffb04edc82d93bd0a25facea679f834967b7fb6c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T12:10:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8afc556fbda3c92f1513f8bbca03c47e8e3305fe20b62d6c7b046a1f8fd665f6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-23T12:10:23Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-23T12:10:23Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["8afc556fbda3c92f1513f8bbca03c47e8e3305fe20b62d6c7b046a1f8fd665f6"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T12:10:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/91ff65466604b48b00e17894964b591a2864ec656863d631725c2ba55b7edbf7"}
{"level":"info","ts":"2026-07-23T12:10:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/76bfb1bfcd6e59a13edb559fcdac15f670326082ec68746f16d920db5c446626"}
{"level":"info","ts":"2026-07-23T12:10:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8afc556fbda3c92f1513f8bbca03c47e8e3305fe20b62d6c7b046a1f8fd665f6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T12:10:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"91ff65466604b48b00e17894964b591a2864ec656863d631725c2ba55b7edbf7","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-23T12:10:23Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-23T12:10:23Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["91ff65466604b48b00e17894964b591a2864ec656863d631725c2ba55b7edbf7"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T12:10:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/310669938e8914e6285c9258ffb04edc82d93bd0a25facea679f834967b7fb6c"}
{"level":"info","ts":"2026-07-23T12:10:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8afc556fbda3c92f1513f8bbca03c47e8e3305fe20b62d6c7b046a1f8fd665f6"}
{"level":"info","ts":"2026-07-23T12:10:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"91ff65466604b48b00e17894964b591a2864ec656863d631725c2ba55b7edbf7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T12:10:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"76bfb1bfcd6e59a13edb559fcdac15f670326082ec68746f16d920db5c446626","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-23T12:10:23Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-23T12:10:23Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["76bfb1bfcd6e59a13edb559fcdac15f670326082ec68746f16d920db5c446626"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T12:10:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/91ff65466604b48b00e17894964b591a2864ec656863d631725c2ba55b7edbf7"}
{"level":"info","ts":"2026-07-23T12:10:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/52ba7ccae2a9fcf79466a8818ea2921622a6a48e235d25d68fc1ab61b5456fab"}
{"level":"info","ts":"2026-07-23T12:10:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"76bfb1bfcd6e59a13edb559fcdac15f670326082ec68746f16d920db5c446626","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T12:10:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"310669938e8914e6285c9258ffb04edc82d93bd0a25facea679f834967b7fb6c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T12:10:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8afc556fbda3c92f1513f8bbca03c47e8e3305fe20b62d6c7b046a1f8fd665f6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T12:10:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"91ff65466604b48b00e17894964b591a2864ec656863d631725c2ba55b7edbf7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T12:10:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"52ba7ccae2a9fcf79466a8818ea2921622a6a48e235d25d68fc1ab61b5456fab","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-23T12:10:23Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-23T12:10:23Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["52ba7ccae2a9fcf79466a8818ea2921622a6a48e235d25d68fc1ab61b5456fab"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T12:10:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/76bfb1bfcd6e59a13edb559fcdac15f670326082ec68746f16d920db5c446626"}
{"level":"info","ts":"2026-07-23T12:10:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"52ba7ccae2a9fcf79466a8818ea2921622a6a48e235d25d68fc1ab61b5456fab","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T12:10:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"76bfb1bfcd6e59a13edb559fcdac15f670326082ec68746f16d920db5c446626","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T12:10:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d5e91dfd57cda145450a896cb13ba9ec5bc9b02905309d3f040c6861afd2c5c0","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-23T12:10:23Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-23T12:10:23Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T12:10:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d5e91dfd57cda145450a896cb13ba9ec5bc9b02905309d3f040c6861afd2c5c0"}
{"level":"info","ts":"2026-07-23T12:10:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/52ba7ccae2a9fcf79466a8818ea2921622a6a48e235d25d68fc1ab61b5456fab"}
{"level":"info","ts":"2026-07-23T12:10:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d5e91dfd57cda145450a896cb13ba9ec5bc9b02905309d3f040c6861afd2c5c0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T12:10:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"52ba7ccae2a9fcf79466a8818ea2921622a6a48e235d25d68fc1ab61b5456fab","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T12:10:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8a3506ff2caaf06e30de7d65e03b2c6219c22dda5c5f406194b78d14e999bd25","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-23T12:10:23Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-23T12:10:23Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T12:10:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8a3506ff2caaf06e30de7d65e03b2c6219c22dda5c5f406194b78d14e999bd25"}
{"level":"info","ts":"2026-07-23T12:10:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d5e91dfd57cda145450a896cb13ba9ec5bc9b02905309d3f040c6861afd2c5c0"}
{"level":"info","ts":"2026-07-23T12:10:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8a3506ff2caaf06e30de7d65e03b2c6219c22dda5c5f406194b78d14e999bd25","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T12:10:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"d5e91dfd57cda145450a896cb13ba9ec5bc9b02905309d3f040c6861afd2c5c0","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-23T12:10:23Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-23T12:10:23Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["d5e91dfd57cda145450a896cb13ba9ec5bc9b02905309d3f040c6861afd2c5c0"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T12:10:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0bcadb8aa503d40ba4e1c66d478593e1d6a424a1f212bfea62a6b105160a0409"}
{"level":"info","ts":"2026-07-23T12:10:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8a3506ff2caaf06e30de7d65e03b2c6219c22dda5c5f406194b78d14e999bd25"}
{"level":"info","ts":"2026-07-23T12:10:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"d5e91dfd57cda145450a896cb13ba9ec5bc9b02905309d3f040c6861afd2c5c0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T12:10:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"0bcadb8aa503d40ba4e1c66d478593e1d6a424a1f212bfea62a6b105160a0409","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-23T12:10:23Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-23T12:10:23Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["0bcadb8aa503d40ba4e1c66d478593e1d6a424a1f212bfea62a6b105160a0409"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T12:10:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ffc3ea9478530db1ebce7b1de910bca85bf3a9ab93a5b0243845c343912db4a9"}
{"level":"info","ts":"2026-07-23T12:10:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"0bcadb8aa503d40ba4e1c66d478593e1d6a424a1f212bfea62a6b105160a0409","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T12:10:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8a3506ff2caaf06e30de7d65e03b2c6219c22dda5c5f406194b78d14e999bd25","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-23T12:10:23Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-23T12:10:23Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["8a3506ff2caaf06e30de7d65e03b2c6219c22dda5c5f406194b78d14e999bd25"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T12:10:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b881693c087074f26f875ad5a251bcfa756e1f04988d08d3cde118b29fe09fe5"}
{"level":"info","ts":"2026-07-23T12:10:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/971135a5fcf29b26ac81569c66f777b249ae7fbac8d473611e1edb607bd0bb30"}
{"level":"info","ts":"2026-07-23T12:10:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8a3506ff2caaf06e30de7d65e03b2c6219c22dda5c5f406194b78d14e999bd25","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T12:10:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"ffc3ea9478530db1ebce7b1de910bca85bf3a9ab93a5b0243845c343912db4a9","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-23T12:10:23Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-23T12:10:23Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["ffc3ea9478530db1ebce7b1de910bca85bf3a9ab93a5b0243845c343912db4a9"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T12:10:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d5e91dfd57cda145450a896cb13ba9ec5bc9b02905309d3f040c6861afd2c5c0"}
{"level":"info","ts":"2026-07-23T12:10:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8b43513434d2697dc726c90e28098eea55536ec772f2b236d2aa36149df0f068"}
{"level":"info","ts":"2026-07-23T12:10:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"ffc3ea9478530db1ebce7b1de910bca85bf3a9ab93a5b0243845c343912db4a9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T12:10:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"b881693c087074f26f875ad5a251bcfa756e1f04988d08d3cde118b29fe09fe5","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-23T12:10:23Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-23T12:10:23Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["b881693c087074f26f875ad5a251bcfa756e1f04988d08d3cde118b29fe09fe5"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T12:10:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0bcadb8aa503d40ba4e1c66d478593e1d6a424a1f212bfea62a6b105160a0409"}
{"level":"info","ts":"2026-07-23T12:10:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/854a589da4137d712f467e7aa12f1ec2dbb840af4e49d040f8ab6de8741f6854"}
{"level":"info","ts":"2026-07-23T12:10:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/285f41b9a5f4fe7e6635498e3fd563b4d6f4c0f21d38f805755be53d38f12b75"}
{"level":"info","ts":"2026-07-23T12:10:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"b881693c087074f26f875ad5a251bcfa756e1f04988d08d3cde118b29fe09fe5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T12:10:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"971135a5fcf29b26ac81569c66f777b249ae7fbac8d473611e1edb607bd0bb30","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-23T12:10:24Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-23T12:10:24Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["971135a5fcf29b26ac81569c66f777b249ae7fbac8d473611e1edb607bd0bb30"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T12:10:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8579d27dba9d2501b729b7268a3c39e68ad30f0235b3a2790a4a8b1ea4821b25"}
{"level":"info","ts":"2026-07-23T12:10:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8a3506ff2caaf06e30de7d65e03b2c6219c22dda5c5f406194b78d14e999bd25"}
{"level":"info","ts":"2026-07-23T12:10:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"971135a5fcf29b26ac81569c66f777b249ae7fbac8d473611e1edb607bd0bb30","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T12:10:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d5e91dfd57cda145450a896cb13ba9ec5bc9b02905309d3f040c6861afd2c5c0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T12:10:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8b43513434d2697dc726c90e28098eea55536ec772f2b236d2aa36149df0f068","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-23T12:10:24Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-23T12:10:24Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["8b43513434d2697dc726c90e28098eea55536ec772f2b236d2aa36149df0f068"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T12:10:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2b45a3b0d7b135044912b7b6f1a854ecc356a3b893c3be84d8871cc5f3126268"}
{"level":"info","ts":"2026-07-23T12:10:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ffc3ea9478530db1ebce7b1de910bca85bf3a9ab93a5b0243845c343912db4a9"}
{"level":"info","ts":"2026-07-23T12:10:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8b43513434d2697dc726c90e28098eea55536ec772f2b236d2aa36149df0f068","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T12:10:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0bcadb8aa503d40ba4e1c66d478593e1d6a424a1f212bfea62a6b105160a0409","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T12:10:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"854a589da4137d712f467e7aa12f1ec2dbb840af4e49d040f8ab6de8741f6854","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-23T12:10:24Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-23T12:10:24Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["854a589da4137d712f467e7aa12f1ec2dbb840af4e49d040f8ab6de8741f6854"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T12:10:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b881693c087074f26f875ad5a251bcfa756e1f04988d08d3cde118b29fe09fe5"}
{"level":"info","ts":"2026-07-23T12:10:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/971135a5fcf29b26ac81569c66f777b249ae7fbac8d473611e1edb607bd0bb30"}
{"level":"info","ts":"2026-07-23T12:10:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8b43513434d2697dc726c90e28098eea55536ec772f2b236d2aa36149df0f068"}
{"level":"info","ts":"2026-07-23T12:10:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"854a589da4137d712f467e7aa12f1ec2dbb840af4e49d040f8ab6de8741f6854","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T12:10:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"285f41b9a5f4fe7e6635498e3fd563b4d6f4c0f21d38f805755be53d38f12b75","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-23T12:10:24Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-23T12:10:24Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["285f41b9a5f4fe7e6635498e3fd563b4d6f4c0f21d38f805755be53d38f12b75"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T12:10:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/854a589da4137d712f467e7aa12f1ec2dbb840af4e49d040f8ab6de8741f6854"}
{"level":"info","ts":"2026-07-23T12:10:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"285f41b9a5f4fe7e6635498e3fd563b4d6f4c0f21d38f805755be53d38f12b75","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T12:10:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"8579d27dba9d2501b729b7268a3c39e68ad30f0235b3a2790a4a8b1ea4821b25","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-23T12:10:24Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-23T12:10:24Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["8579d27dba9d2501b729b7268a3c39e68ad30f0235b3a2790a4a8b1ea4821b25"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T12:10:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/285f41b9a5f4fe7e6635498e3fd563b4d6f4c0f21d38f805755be53d38f12b75"}
{"level":"info","ts":"2026-07-23T12:10:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"8579d27dba9d2501b729b7268a3c39e68ad30f0235b3a2790a4a8b1ea4821b25","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T12:10:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8a3506ff2caaf06e30de7d65e03b2c6219c22dda5c5f406194b78d14e999bd25","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T12:10:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2b45a3b0d7b135044912b7b6f1a854ecc356a3b893c3be84d8871cc5f3126268","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-23T12:10:24Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-23T12:10:24Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["2b45a3b0d7b135044912b7b6f1a854ecc356a3b893c3be84d8871cc5f3126268"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-23T12:10:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8579d27dba9d2501b729b7268a3c39e68ad30f0235b3a2790a4a8b1ea4821b25"}
{"level":"info","ts":"2026-07-23T12:10:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2b45a3b0d7b135044912b7b6f1a854ecc356a3b893c3be84d8871cc5f3126268","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T12:10:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ffc3ea9478530db1ebce7b1de910bca85bf3a9ab93a5b0243845c343912db4a9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T12:10:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b881693c087074f26f875ad5a251bcfa756e1f04988d08d3cde118b29fe09fe5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T12:10:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"971135a5fcf29b26ac81569c66f777b249ae7fbac8d473611e1edb607bd0bb30","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T12:10:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8b43513434d2697dc726c90e28098eea55536ec772f2b236d2aa36149df0f068","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T12:10:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"854a589da4137d712f467e7aa12f1ec2dbb840af4e49d040f8ab6de8741f6854","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T12:10:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"285f41b9a5f4fe7e6635498e3fd563b4d6f4c0f21d38f805755be53d38f12b75","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T12:10:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8579d27dba9d2501b729b7268a3c39e68ad30f0235b3a2790a4a8b1ea4821b25","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-23T12:10:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2b45a3b0d7b135044912b7b6f1a854ecc356a3b893c3be84d8871cc5f3126268","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-23T12:10:24Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2b45a3b0d7b135044912b7b6f1a854ecc356a3b893c3be84d8871cc5f3126268"}
{"level":"info","ts":"2026-07-23T12:10:28Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1b9f90bd-c7c8-41e1-a2c5-515738c220b2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:43676","PortSpecifier":{"PortValue":43676}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.79:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"1b9f90bd-c7c8-41e1-a2c5-515738c220b2","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-7cc2e5.apps.df24a0d5-18ed-42c5-8ad0-608660f19de8.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-23T12:10:28Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1b9f90bd-c7c8-41e1-a2c5-515738c220b2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:43676","PortSpecifier":{"PortValue":43676}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.79:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784808628,"nanos":709583490},"http":{"id":"1b9f90bd-c7c8-41e1-a2c5-515738c220b2","method":"POST","headers":{":authority":"e2e-shared-a-7cc2e5.apps.df24a0d5-18ed-42c5-8ad0-608660f19de8.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-23T12:10:28Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"1b9f90bd-c7c8-41e1-a2c5-515738c220b2","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-23T12:10:28Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"1b9f90bd-c7c8-41e1-a2c5-515738c220b2","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"5ef4894a-e528-4c9e-8d31-05017ccb6d4d","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=6628e0a3-15e5-4e8e-a44b-049958b54524"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/608660f19de8"]}}
{"level":"debug","ts":"2026-07-23T12:10:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"1b9f90bd-c7c8-41e1-a2c5-515738c220b2","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/608660f19de8"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=6628e0a3-15e5-4e8e-a44b-049958b54524"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"5ef4894a-e528-4c9e-8d31-05017ccb6d4d","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"dbae7e17e6ca91fa930c462181959d5c386e4efd387f348d4c2b92298d449d2e"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.79:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-7cc2e5.apps.df24a0d5-18ed-42c5-8ad0-608660f19de8.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-23T12:10:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1b9f90bd-c7c8-41e1-a2c5-515738c220b2","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T12:10:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1b9f90bd-c7c8-41e1-a2c5-515738c220b2","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T12:10:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1b9f90bd-c7c8-41e1-a2c5-515738c220b2","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-7cc2e5/rate-test-model-7cc2e5\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-7cc2e5/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T12:10:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"1b9f90bd-c7c8-41e1-a2c5-515738c220b2","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-23T12:10:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1b9f90bd-c7c8-41e1-a2c5-515738c220b2","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-23T12:10:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1b9f90bd-c7c8-41e1-a2c5-515738c220b2","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-23T12:10:28Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1b9f90bd-c7c8-41e1-a2c5-515738c220b2","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-23T12:10:28Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1b9f90bd-c7c8-41e1-a2c5-515738c220b2","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-23T12:10:28Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"321a96c3-3231-44ce-8ac7-fd5c14c431b5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:50238","PortSpecifier":{"PortValue":50238}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.80:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"321a96c3-3231-44ce-8ac7-fd5c14c431b5","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-77f87c.apps.df24a0d5-18ed-42c5-8ad0-608660f19de8.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-23T12:10:28Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"321a96c3-3231-44ce-8ac7-fd5c14c431b5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:50238","PortSpecifier":{"PortValue":50238}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.80:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784808628,"nanos":771726766},"http":{"id":"321a96c3-3231-44ce-8ac7-fd5c14c431b5","method":"POST","headers":{":authority":"e2e-shared-b-77f87c.apps.df24a0d5-18ed-42c5-8ad0-608660f19de8.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-23T12:10:28Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"321a96c3-3231-44ce-8ac7-fd5c14c431b5","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-23T12:10:28Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"321a96c3-3231-44ce-8ac7-fd5c14c431b5","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"5ef4894a-e528-4c9e-8d31-05017ccb6d4d","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=6628e0a3-15e5-4e8e-a44b-049958b54524"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/608660f19de8"]}}
{"level":"debug","ts":"2026-07-23T12:10:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"321a96c3-3231-44ce-8ac7-fd5c14c431b5","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/608660f19de8"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=6628e0a3-15e5-4e8e-a44b-049958b54524"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"5ef4894a-e528-4c9e-8d31-05017ccb6d4d","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"8b43513434d2697dc726c90e28098eea55536ec772f2b236d2aa36149df0f068"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.80:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-77f87c.apps.df24a0d5-18ed-42c5-8ad0-608660f19de8.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-23T12:10:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"321a96c3-3231-44ce-8ac7-fd5c14c431b5","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T12:10:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"321a96c3-3231-44ce-8ac7-fd5c14c431b5","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T12:10:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"321a96c3-3231-44ce-8ac7-fd5c14c431b5","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-77f87c/rate-test-model-77f87c\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-77f87c/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T12:10:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"321a96c3-3231-44ce-8ac7-fd5c14c431b5","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-23T12:10:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"321a96c3-3231-44ce-8ac7-fd5c14c431b5","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-23T12:10:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"321a96c3-3231-44ce-8ac7-fd5c14c431b5","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-23T12:10:28Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"321a96c3-3231-44ce-8ac7-fd5c14c431b5","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-23T12:10:28Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"321a96c3-3231-44ce-8ac7-fd5c14c431b5","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-23T12:10:28Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a70063dc-959c-40db-a135-36b590e25e1d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:43684","PortSpecifier":{"PortValue":43684}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.79:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"a70063dc-959c-40db-a135-36b590e25e1d","method":"POST","path":"/ai-tenant-e2e-shared-a-7cc2e5/rate-test-model-7cc2e5/v1/completions","host":"e2e-shared-a-7cc2e5.apps.df24a0d5-18ed-42c5-8ad0-608660f19de8.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-23T12:10:28Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a70063dc-959c-40db-a135-36b590e25e1d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:43684","PortSpecifier":{"PortValue":43684}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.79:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784808628,"nanos":835262220},"http":{"id":"a70063dc-959c-40db-a135-36b590e25e1d","method":"POST","headers":{":authority":"e2e-shared-a-7cc2e5.apps.df24a0d5-18ed-42c5-8ad0-608660f19de8.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-7cc2e5/rate-test-model-7cc2e5/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-23T12:10:28Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"a70063dc-959c-40db-a135-36b590e25e1d","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-XA7tvaKXUYmZXuF0_Y3wLIqffylHD54YE9YpTnojIdgWDZsDBtxUhVvKTsLo"}
{"level":"debug","ts":"2026-07-23T12:10:28Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a70063dc-959c-40db-a135-36b590e25e1d","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-7cc2e5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-XA7tvaKXUYmZXuF0_Y3wLIqffylHD54YE9YpTnojIdgWDZsDBtxUhVvKTsLo\"}"}
{"level":"debug","ts":"2026-07-23T12:10:28Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a70063dc-959c-40db-a135-36b590e25e1d","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7cc2e5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"60486649-1552-4206-9405-7b2b6f9840f3","keyName":"e2e-rate-a-15f56a","subscription":"e2e-rate-iso-a-15f56a","tenant":"e2e-shared-a-7cc2e5","userId":"60486649-1552-4206-9405-7b2b6f9840f3","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-23T12:10:28Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a70063dc-959c-40db-a135-36b590e25e1d","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-7cc2e5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-7cc2e5/rate-test-model-7cc2e5\",\"requestedSubscription\":\"e2e-rate-iso-a-15f56a\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-23T12:10:28Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a70063dc-959c-40db-a135-36b590e25e1d","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7cc2e5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-7cc2e5","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-15f56a","namespace":"ai-tenant-e2e-shared-a-7cc2e5","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-7cc2e5/rate-test-model-7cc2e5"}}
{"level":"debug","ts":"2026-07-23T12:10:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"a70063dc-959c-40db-a135-36b590e25e1d","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-23T12:10:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a70063dc-959c-40db-a135-36b590e25e1d","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T12:10:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a70063dc-959c-40db-a135-36b590e25e1d","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T12:10:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a70063dc-959c-40db-a135-36b590e25e1d","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-7cc2e5/rate-test-model-7cc2e5\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-7cc2e5/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T12:10:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a70063dc-959c-40db-a135-36b590e25e1d","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T12:10:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a70063dc-959c-40db-a135-36b590e25e1d","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-23T12:10:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a70063dc-959c-40db-a135-36b590e25e1d","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-23T12:10:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a70063dc-959c-40db-a135-36b590e25e1d","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-15f56a"}
{"level":"debug","ts":"2026-07-23T12:10:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a70063dc-959c-40db-a135-36b590e25e1d","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"60486649-1552-4206-9405-7b2b6f9840f3","keyName":"e2e-rate-a-15f56a","selected_subscription":"e2e-rate-iso-a-15f56a","selected_subscription_key":"ai-tenant-e2e-shared-a-7cc2e5/e2e-rate-iso-a-15f56a@ai-tenant-e2e-shared-a-7cc2e5/rate-test-model-7cc2e5","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-7cc2e5","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-15f56a","namespace":"ai-tenant-e2e-shared-a-7cc2e5","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-7cc2e5/rate-test-model-7cc2e5"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-23T12:10:28Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a70063dc-959c-40db-a135-36b590e25e1d","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-23T12:10:28Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a70063dc-959c-40db-a135-36b590e25e1d","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-23T12:10:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9ef30f00-9765-4088-9fe9-b55b6899f972","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:43688","PortSpecifier":{"PortValue":43688}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.79:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"9ef30f00-9765-4088-9fe9-b55b6899f972","method":"POST","path":"/ai-tenant-e2e-shared-a-7cc2e5/rate-test-model-7cc2e5/v1/completions","host":"e2e-shared-a-7cc2e5.apps.df24a0d5-18ed-42c5-8ad0-608660f19de8.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-23T12:10:29Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9ef30f00-9765-4088-9fe9-b55b6899f972","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:43688","PortSpecifier":{"PortValue":43688}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.79:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784808629,"nanos":896562066},"http":{"id":"9ef30f00-9765-4088-9fe9-b55b6899f972","method":"POST","headers":{":authority":"e2e-shared-a-7cc2e5.apps.df24a0d5-18ed-42c5-8ad0-608660f19de8.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-7cc2e5/rate-test-model-7cc2e5/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-23T12:10:29Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"9ef30f00-9765-4088-9fe9-b55b6899f972","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-XA7tvaKXUYmZXuF0_Y3wLIqffylHD54YE9YpTnojIdgWDZsDBtxUhVvKTsLo"}
{"level":"debug","ts":"2026-07-23T12:10:29Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"9ef30f00-9765-4088-9fe9-b55b6899f972","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-7cc2e5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-XA7tvaKXUYmZXuF0_Y3wLIqffylHD54YE9YpTnojIdgWDZsDBtxUhVvKTsLo\"}"}
{"level":"debug","ts":"2026-07-23T12:10:29Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"9ef30f00-9765-4088-9fe9-b55b6899f972","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7cc2e5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"60486649-1552-4206-9405-7b2b6f9840f3","keyName":"e2e-rate-a-15f56a","subscription":"e2e-rate-iso-a-15f56a","tenant":"e2e-shared-a-7cc2e5","userId":"60486649-1552-4206-9405-7b2b6f9840f3","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-23T12:10:29Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"9ef30f00-9765-4088-9fe9-b55b6899f972","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-7cc2e5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-7cc2e5/rate-test-model-7cc2e5\",\"requestedSubscription\":\"e2e-rate-iso-a-15f56a\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-23T12:10:29Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"9ef30f00-9765-4088-9fe9-b55b6899f972","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7cc2e5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-7cc2e5","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-15f56a","namespace":"ai-tenant-e2e-shared-a-7cc2e5","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-7cc2e5/rate-test-model-7cc2e5"}}
{"level":"debug","ts":"2026-07-23T12:10:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"9ef30f00-9765-4088-9fe9-b55b6899f972","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-23T12:10:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9ef30f00-9765-4088-9fe9-b55b6899f972","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T12:10:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9ef30f00-9765-4088-9fe9-b55b6899f972","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T12:10:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9ef30f00-9765-4088-9fe9-b55b6899f972","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T12:10:29Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9ef30f00-9765-4088-9fe9-b55b6899f972","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-7cc2e5/rate-test-model-7cc2e5\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-7cc2e5/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T12:10:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9ef30f00-9765-4088-9fe9-b55b6899f972","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-23T12:10:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9ef30f00-9765-4088-9fe9-b55b6899f972","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-23T12:10:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9ef30f00-9765-4088-9fe9-b55b6899f972","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-15f56a"}
{"level":"debug","ts":"2026-07-23T12:10:29Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9ef30f00-9765-4088-9fe9-b55b6899f972","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"60486649-1552-4206-9405-7b2b6f9840f3","keyName":"e2e-rate-a-15f56a","selected_subscription":"e2e-rate-iso-a-15f56a","selected_subscription_key":"ai-tenant-e2e-shared-a-7cc2e5/e2e-rate-iso-a-15f56a@ai-tenant-e2e-shared-a-7cc2e5/rate-test-model-7cc2e5","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-7cc2e5","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-15f56a","namespace":"ai-tenant-e2e-shared-a-7cc2e5","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-7cc2e5/rate-test-model-7cc2e5"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-23T12:10:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9ef30f00-9765-4088-9fe9-b55b6899f972","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-23T12:10:29Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9ef30f00-9765-4088-9fe9-b55b6899f972","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-23T12:10:30Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a49825dd-b480-4638-b1c7-02da837887fb","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:43690","PortSpecifier":{"PortValue":43690}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.79:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"a49825dd-b480-4638-b1c7-02da837887fb","method":"POST","path":"/ai-tenant-e2e-shared-a-7cc2e5/rate-test-model-7cc2e5/v1/completions","host":"e2e-shared-a-7cc2e5.apps.df24a0d5-18ed-42c5-8ad0-608660f19de8.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-23T12:10:30Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a49825dd-b480-4638-b1c7-02da837887fb","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:43690","PortSpecifier":{"PortValue":43690}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.79:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784808630,"nanos":934089072},"http":{"id":"a49825dd-b480-4638-b1c7-02da837887fb","method":"POST","headers":{":authority":"e2e-shared-a-7cc2e5.apps.df24a0d5-18ed-42c5-8ad0-608660f19de8.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-7cc2e5/rate-test-model-7cc2e5/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-23T12:10:30Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"a49825dd-b480-4638-b1c7-02da837887fb","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-XA7tvaKXUYmZXuF0_Y3wLIqffylHD54YE9YpTnojIdgWDZsDBtxUhVvKTsLo"}
{"level":"debug","ts":"2026-07-23T12:10:30Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a49825dd-b480-4638-b1c7-02da837887fb","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-7cc2e5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-XA7tvaKXUYmZXuF0_Y3wLIqffylHD54YE9YpTnojIdgWDZsDBtxUhVvKTsLo\"}"}
{"level":"debug","ts":"2026-07-23T12:10:30Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a49825dd-b480-4638-b1c7-02da837887fb","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7cc2e5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"60486649-1552-4206-9405-7b2b6f9840f3","keyName":"e2e-rate-a-15f56a","subscription":"e2e-rate-iso-a-15f56a","tenant":"e2e-shared-a-7cc2e5","userId":"60486649-1552-4206-9405-7b2b6f9840f3","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-23T12:10:30Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a49825dd-b480-4638-b1c7-02da837887fb","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-7cc2e5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-7cc2e5/rate-test-model-7cc2e5\",\"requestedSubscription\":\"e2e-rate-iso-a-15f56a\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-23T12:10:30Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a49825dd-b480-4638-b1c7-02da837887fb","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7cc2e5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-7cc2e5","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-15f56a","namespace":"ai-tenant-e2e-shared-a-7cc2e5","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-7cc2e5/rate-test-model-7cc2e5"}}
{"level":"debug","ts":"2026-07-23T12:10:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"a49825dd-b480-4638-b1c7-02da837887fb","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-23T12:10:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a49825dd-b480-4638-b1c7-02da837887fb","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T12:10:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a49825dd-b480-4638-b1c7-02da837887fb","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T12:10:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a49825dd-b480-4638-b1c7-02da837887fb","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T12:10:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a49825dd-b480-4638-b1c7-02da837887fb","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-7cc2e5/rate-test-model-7cc2e5\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-7cc2e5/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T12:10:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a49825dd-b480-4638-b1c7-02da837887fb","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-23T12:10:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a49825dd-b480-4638-b1c7-02da837887fb","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-23T12:10:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a49825dd-b480-4638-b1c7-02da837887fb","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-15f56a"}
{"level":"debug","ts":"2026-07-23T12:10:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a49825dd-b480-4638-b1c7-02da837887fb","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"60486649-1552-4206-9405-7b2b6f9840f3","keyName":"e2e-rate-a-15f56a","selected_subscription":"e2e-rate-iso-a-15f56a","selected_subscription_key":"ai-tenant-e2e-shared-a-7cc2e5/e2e-rate-iso-a-15f56a@ai-tenant-e2e-shared-a-7cc2e5/rate-test-model-7cc2e5","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-7cc2e5","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-15f56a","namespace":"ai-tenant-e2e-shared-a-7cc2e5","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-7cc2e5/rate-test-model-7cc2e5"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-23T12:10:30Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a49825dd-b480-4638-b1c7-02da837887fb","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-23T12:10:30Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a49825dd-b480-4638-b1c7-02da837887fb","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-23T12:10:31Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"86fe72fc-ce1a-4d32-91f5-fdfcad26a5bb","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:43700","PortSpecifier":{"PortValue":43700}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.79:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"86fe72fc-ce1a-4d32-91f5-fdfcad26a5bb","method":"POST","path":"/ai-tenant-e2e-shared-a-7cc2e5/rate-test-model-7cc2e5/v1/completions","host":"e2e-shared-a-7cc2e5.apps.df24a0d5-18ed-42c5-8ad0-608660f19de8.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-23T12:10:31Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"86fe72fc-ce1a-4d32-91f5-fdfcad26a5bb","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:43700","PortSpecifier":{"PortValue":43700}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.79:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784808631,"nanos":967658371},"http":{"id":"86fe72fc-ce1a-4d32-91f5-fdfcad26a5bb","method":"POST","headers":{":authority":"e2e-shared-a-7cc2e5.apps.df24a0d5-18ed-42c5-8ad0-608660f19de8.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-7cc2e5/rate-test-model-7cc2e5/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-23T12:10:31Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"86fe72fc-ce1a-4d32-91f5-fdfcad26a5bb","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-XA7tvaKXUYmZXuF0_Y3wLIqffylHD54YE9YpTnojIdgWDZsDBtxUhVvKTsLo"}
{"level":"debug","ts":"2026-07-23T12:10:31Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"86fe72fc-ce1a-4d32-91f5-fdfcad26a5bb","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-7cc2e5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-XA7tvaKXUYmZXuF0_Y3wLIqffylHD54YE9YpTnojIdgWDZsDBtxUhVvKTsLo\"}"}
{"level":"debug","ts":"2026-07-23T12:10:31Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"86fe72fc-ce1a-4d32-91f5-fdfcad26a5bb","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7cc2e5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"60486649-1552-4206-9405-7b2b6f9840f3","keyName":"e2e-rate-a-15f56a","subscription":"e2e-rate-iso-a-15f56a","tenant":"e2e-shared-a-7cc2e5","userId":"60486649-1552-4206-9405-7b2b6f9840f3","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-23T12:10:31Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"86fe72fc-ce1a-4d32-91f5-fdfcad26a5bb","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-7cc2e5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-7cc2e5/rate-test-model-7cc2e5\",\"requestedSubscription\":\"e2e-rate-iso-a-15f56a\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-23T12:10:31Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"86fe72fc-ce1a-4d32-91f5-fdfcad26a5bb","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7cc2e5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-7cc2e5","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-15f56a","namespace":"ai-tenant-e2e-shared-a-7cc2e5","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-7cc2e5/rate-test-model-7cc2e5"}}
{"level":"debug","ts":"2026-07-23T12:10:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"86fe72fc-ce1a-4d32-91f5-fdfcad26a5bb","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-23T12:10:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"86fe72fc-ce1a-4d32-91f5-fdfcad26a5bb","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T12:10:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"86fe72fc-ce1a-4d32-91f5-fdfcad26a5bb","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T12:10:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"86fe72fc-ce1a-4d32-91f5-fdfcad26a5bb","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-7cc2e5/rate-test-model-7cc2e5\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-7cc2e5/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T12:10:31Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"86fe72fc-ce1a-4d32-91f5-fdfcad26a5bb","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T12:10:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"86fe72fc-ce1a-4d32-91f5-fdfcad26a5bb","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-23T12:10:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"86fe72fc-ce1a-4d32-91f5-fdfcad26a5bb","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-15f56a"}
{"level":"debug","ts":"2026-07-23T12:10:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"86fe72fc-ce1a-4d32-91f5-fdfcad26a5bb","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-23T12:10:31Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"86fe72fc-ce1a-4d32-91f5-fdfcad26a5bb","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"60486649-1552-4206-9405-7b2b6f9840f3","keyName":"e2e-rate-a-15f56a","selected_subscription":"e2e-rate-iso-a-15f56a","selected_subscription_key":"ai-tenant-e2e-shared-a-7cc2e5/e2e-rate-iso-a-15f56a@ai-tenant-e2e-shared-a-7cc2e5/rate-test-model-7cc2e5","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-7cc2e5","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-15f56a","namespace":"ai-tenant-e2e-shared-a-7cc2e5","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-7cc2e5/rate-test-model-7cc2e5"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-23T12:10:31Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"86fe72fc-ce1a-4d32-91f5-fdfcad26a5bb","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-23T12:10:31Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"86fe72fc-ce1a-4d32-91f5-fdfcad26a5bb","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-23T12:10:33Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"17bcad72-2e59-408f-93eb-a2a3fca879de","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:55722","PortSpecifier":{"PortValue":55722}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.79:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"17bcad72-2e59-408f-93eb-a2a3fca879de","method":"POST","path":"/ai-tenant-e2e-shared-a-7cc2e5/rate-test-model-7cc2e5/v1/completions","host":"e2e-shared-a-7cc2e5.apps.df24a0d5-18ed-42c5-8ad0-608660f19de8.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-23T12:10:33Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"17bcad72-2e59-408f-93eb-a2a3fca879de","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:55722","PortSpecifier":{"PortValue":55722}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.79:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784808633,"nanos":4821312},"http":{"id":"17bcad72-2e59-408f-93eb-a2a3fca879de","method":"POST","headers":{":authority":"e2e-shared-a-7cc2e5.apps.df24a0d5-18ed-42c5-8ad0-608660f19de8.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-7cc2e5/rate-test-model-7cc2e5/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-23T12:10:33Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"17bcad72-2e59-408f-93eb-a2a3fca879de","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-XA7tvaKXUYmZXuF0_Y3wLIqffylHD54YE9YpTnojIdgWDZsDBtxUhVvKTsLo"}
{"level":"debug","ts":"2026-07-23T12:10:33Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"17bcad72-2e59-408f-93eb-a2a3fca879de","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-7cc2e5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-XA7tvaKXUYmZXuF0_Y3wLIqffylHD54YE9YpTnojIdgWDZsDBtxUhVvKTsLo\"}"}
{"level":"debug","ts":"2026-07-23T12:10:33Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"17bcad72-2e59-408f-93eb-a2a3fca879de","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7cc2e5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"60486649-1552-4206-9405-7b2b6f9840f3","keyName":"e2e-rate-a-15f56a","subscription":"e2e-rate-iso-a-15f56a","tenant":"e2e-shared-a-7cc2e5","userId":"60486649-1552-4206-9405-7b2b6f9840f3","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-23T12:10:33Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"17bcad72-2e59-408f-93eb-a2a3fca879de","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-7cc2e5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-7cc2e5/rate-test-model-7cc2e5\",\"requestedSubscription\":\"e2e-rate-iso-a-15f56a\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-23T12:10:33Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"17bcad72-2e59-408f-93eb-a2a3fca879de","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7cc2e5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-7cc2e5","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-15f56a","namespace":"ai-tenant-e2e-shared-a-7cc2e5","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-7cc2e5/rate-test-model-7cc2e5"}}
{"level":"debug","ts":"2026-07-23T12:10:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"17bcad72-2e59-408f-93eb-a2a3fca879de","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-23T12:10:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"17bcad72-2e59-408f-93eb-a2a3fca879de","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T12:10:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"17bcad72-2e59-408f-93eb-a2a3fca879de","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T12:10:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"17bcad72-2e59-408f-93eb-a2a3fca879de","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T12:10:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"17bcad72-2e59-408f-93eb-a2a3fca879de","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-7cc2e5/rate-test-model-7cc2e5\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-7cc2e5/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T12:10:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"17bcad72-2e59-408f-93eb-a2a3fca879de","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-15f56a"}
{"level":"debug","ts":"2026-07-23T12:10:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"17bcad72-2e59-408f-93eb-a2a3fca879de","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-23T12:10:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"17bcad72-2e59-408f-93eb-a2a3fca879de","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-23T12:10:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"17bcad72-2e59-408f-93eb-a2a3fca879de","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"60486649-1552-4206-9405-7b2b6f9840f3","keyName":"e2e-rate-a-15f56a","selected_subscription":"e2e-rate-iso-a-15f56a","selected_subscription_key":"ai-tenant-e2e-shared-a-7cc2e5/e2e-rate-iso-a-15f56a@ai-tenant-e2e-shared-a-7cc2e5/rate-test-model-7cc2e5","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-7cc2e5","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-15f56a","namespace":"ai-tenant-e2e-shared-a-7cc2e5","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-7cc2e5/rate-test-model-7cc2e5"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-23T12:10:33Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"17bcad72-2e59-408f-93eb-a2a3fca879de","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-23T12:10:33Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"17bcad72-2e59-408f-93eb-a2a3fca879de","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-23T12:10:34Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ae3c508b-37bb-4914-ae94-f92b201eac5d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:55726","PortSpecifier":{"PortValue":55726}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.79:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"ae3c508b-37bb-4914-ae94-f92b201eac5d","method":"POST","path":"/ai-tenant-e2e-shared-a-7cc2e5/rate-test-model-7cc2e5/v1/completions","host":"e2e-shared-a-7cc2e5.apps.df24a0d5-18ed-42c5-8ad0-608660f19de8.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-23T12:10:34Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ae3c508b-37bb-4914-ae94-f92b201eac5d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:55726","PortSpecifier":{"PortValue":55726}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.79:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784808634,"nanos":41617094},"http":{"id":"ae3c508b-37bb-4914-ae94-f92b201eac5d","method":"POST","headers":{":authority":"e2e-shared-a-7cc2e5.apps.df24a0d5-18ed-42c5-8ad0-608660f19de8.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-7cc2e5/rate-test-model-7cc2e5/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-23T12:10:34Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"ae3c508b-37bb-4914-ae94-f92b201eac5d","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-XA7tvaKXUYmZXuF0_Y3wLIqffylHD54YE9YpTnojIdgWDZsDBtxUhVvKTsLo"}
{"level":"debug","ts":"2026-07-23T12:10:34Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"ae3c508b-37bb-4914-ae94-f92b201eac5d","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-7cc2e5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-XA7tvaKXUYmZXuF0_Y3wLIqffylHD54YE9YpTnojIdgWDZsDBtxUhVvKTsLo\"}"}
{"level":"debug","ts":"2026-07-23T12:10:34Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"ae3c508b-37bb-4914-ae94-f92b201eac5d","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7cc2e5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"60486649-1552-4206-9405-7b2b6f9840f3","keyName":"e2e-rate-a-15f56a","subscription":"e2e-rate-iso-a-15f56a","tenant":"e2e-shared-a-7cc2e5","userId":"60486649-1552-4206-9405-7b2b6f9840f3","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-23T12:10:34Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"ae3c508b-37bb-4914-ae94-f92b201eac5d","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-7cc2e5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-7cc2e5/rate-test-model-7cc2e5\",\"requestedSubscription\":\"e2e-rate-iso-a-15f56a\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-23T12:10:34Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"ae3c508b-37bb-4914-ae94-f92b201eac5d","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7cc2e5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-7cc2e5","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-15f56a","namespace":"ai-tenant-e2e-shared-a-7cc2e5","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-7cc2e5/rate-test-model-7cc2e5"}}
{"level":"debug","ts":"2026-07-23T12:10:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"ae3c508b-37bb-4914-ae94-f92b201eac5d","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-23T12:10:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ae3c508b-37bb-4914-ae94-f92b201eac5d","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T12:10:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ae3c508b-37bb-4914-ae94-f92b201eac5d","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T12:10:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ae3c508b-37bb-4914-ae94-f92b201eac5d","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-7cc2e5/rate-test-model-7cc2e5\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-7cc2e5/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T12:10:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ae3c508b-37bb-4914-ae94-f92b201eac5d","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T12:10:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ae3c508b-37bb-4914-ae94-f92b201eac5d","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-23T12:10:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ae3c508b-37bb-4914-ae94-f92b201eac5d","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-15f56a"}
{"level":"debug","ts":"2026-07-23T12:10:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ae3c508b-37bb-4914-ae94-f92b201eac5d","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-23T12:10:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ae3c508b-37bb-4914-ae94-f92b201eac5d","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"60486649-1552-4206-9405-7b2b6f9840f3","keyName":"e2e-rate-a-15f56a","selected_subscription":"e2e-rate-iso-a-15f56a","selected_subscription_key":"ai-tenant-e2e-shared-a-7cc2e5/e2e-rate-iso-a-15f56a@ai-tenant-e2e-shared-a-7cc2e5/rate-test-model-7cc2e5","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-7cc2e5","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-15f56a","namespace":"ai-tenant-e2e-shared-a-7cc2e5","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-7cc2e5/rate-test-model-7cc2e5"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-23T12:10:34Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ae3c508b-37bb-4914-ae94-f92b201eac5d","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-23T12:10:34Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ae3c508b-37bb-4914-ae94-f92b201eac5d","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-23T12:10:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ea47dd96-c291-4a92-a85a-baf846a1f8ca","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:55738","PortSpecifier":{"PortValue":55738}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.79:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"ea47dd96-c291-4a92-a85a-baf846a1f8ca","method":"POST","path":"/ai-tenant-e2e-shared-a-7cc2e5/rate-test-model-7cc2e5/v1/completions","host":"e2e-shared-a-7cc2e5.apps.df24a0d5-18ed-42c5-8ad0-608660f19de8.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-23T12:10:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ea47dd96-c291-4a92-a85a-baf846a1f8ca","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:55738","PortSpecifier":{"PortValue":55738}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.79:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784808635,"nanos":75119886},"http":{"id":"ea47dd96-c291-4a92-a85a-baf846a1f8ca","method":"POST","headers":{":authority":"e2e-shared-a-7cc2e5.apps.df24a0d5-18ed-42c5-8ad0-608660f19de8.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-7cc2e5/rate-test-model-7cc2e5/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-23T12:10:35Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"ea47dd96-c291-4a92-a85a-baf846a1f8ca","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-XA7tvaKXUYmZXuF0_Y3wLIqffylHD54YE9YpTnojIdgWDZsDBtxUhVvKTsLo"}
{"level":"debug","ts":"2026-07-23T12:10:35Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"ea47dd96-c291-4a92-a85a-baf846a1f8ca","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-7cc2e5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-XA7tvaKXUYmZXuF0_Y3wLIqffylHD54YE9YpTnojIdgWDZsDBtxUhVvKTsLo\"}"}
{"level":"debug","ts":"2026-07-23T12:10:35Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"ea47dd96-c291-4a92-a85a-baf846a1f8ca","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7cc2e5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"60486649-1552-4206-9405-7b2b6f9840f3","keyName":"e2e-rate-a-15f56a","subscription":"e2e-rate-iso-a-15f56a","tenant":"e2e-shared-a-7cc2e5","userId":"60486649-1552-4206-9405-7b2b6f9840f3","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-23T12:10:35Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"ea47dd96-c291-4a92-a85a-baf846a1f8ca","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-7cc2e5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-7cc2e5/rate-test-model-7cc2e5\",\"requestedSubscription\":\"e2e-rate-iso-a-15f56a\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-23T12:10:35Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"ea47dd96-c291-4a92-a85a-baf846a1f8ca","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7cc2e5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-7cc2e5","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-15f56a","namespace":"ai-tenant-e2e-shared-a-7cc2e5","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-7cc2e5/rate-test-model-7cc2e5"}}
{"level":"debug","ts":"2026-07-23T12:10:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"ea47dd96-c291-4a92-a85a-baf846a1f8ca","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-23T12:10:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ea47dd96-c291-4a92-a85a-baf846a1f8ca","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T12:10:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ea47dd96-c291-4a92-a85a-baf846a1f8ca","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T12:10:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ea47dd96-c291-4a92-a85a-baf846a1f8ca","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-7cc2e5/rate-test-model-7cc2e5\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-7cc2e5/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T12:10:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ea47dd96-c291-4a92-a85a-baf846a1f8ca","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T12:10:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ea47dd96-c291-4a92-a85a-baf846a1f8ca","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-15f56a"}
{"level":"debug","ts":"2026-07-23T12:10:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ea47dd96-c291-4a92-a85a-baf846a1f8ca","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-23T12:10:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ea47dd96-c291-4a92-a85a-baf846a1f8ca","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-23T12:10:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ea47dd96-c291-4a92-a85a-baf846a1f8ca","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"60486649-1552-4206-9405-7b2b6f9840f3","keyName":"e2e-rate-a-15f56a","selected_subscription":"e2e-rate-iso-a-15f56a","selected_subscription_key":"ai-tenant-e2e-shared-a-7cc2e5/e2e-rate-iso-a-15f56a@ai-tenant-e2e-shared-a-7cc2e5/rate-test-model-7cc2e5","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-7cc2e5","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-15f56a","namespace":"ai-tenant-e2e-shared-a-7cc2e5","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-7cc2e5/rate-test-model-7cc2e5"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-23T12:10:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ea47dd96-c291-4a92-a85a-baf846a1f8ca","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-23T12:10:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ea47dd96-c291-4a92-a85a-baf846a1f8ca","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-23T12:10:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a5d340ca-144b-4241-9efb-9364737c5479","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:55750","PortSpecifier":{"PortValue":55750}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.79:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"a5d340ca-144b-4241-9efb-9364737c5479","method":"POST","path":"/ai-tenant-e2e-shared-a-7cc2e5/rate-test-model-7cc2e5/v1/completions","host":"e2e-shared-a-7cc2e5.apps.df24a0d5-18ed-42c5-8ad0-608660f19de8.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-23T12:10:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a5d340ca-144b-4241-9efb-9364737c5479","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:55750","PortSpecifier":{"PortValue":55750}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.79:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784808636,"nanos":116261480},"http":{"id":"a5d340ca-144b-4241-9efb-9364737c5479","method":"POST","headers":{":authority":"e2e-shared-a-7cc2e5.apps.df24a0d5-18ed-42c5-8ad0-608660f19de8.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-7cc2e5/rate-test-model-7cc2e5/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-23T12:10:36Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"a5d340ca-144b-4241-9efb-9364737c5479","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-XA7tvaKXUYmZXuF0_Y3wLIqffylHD54YE9YpTnojIdgWDZsDBtxUhVvKTsLo"}
{"level":"debug","ts":"2026-07-23T12:10:36Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a5d340ca-144b-4241-9efb-9364737c5479","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-7cc2e5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-XA7tvaKXUYmZXuF0_Y3wLIqffylHD54YE9YpTnojIdgWDZsDBtxUhVvKTsLo\"}"}
{"level":"debug","ts":"2026-07-23T12:10:36Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a5d340ca-144b-4241-9efb-9364737c5479","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7cc2e5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"60486649-1552-4206-9405-7b2b6f9840f3","keyName":"e2e-rate-a-15f56a","subscription":"e2e-rate-iso-a-15f56a","tenant":"e2e-shared-a-7cc2e5","userId":"60486649-1552-4206-9405-7b2b6f9840f3","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-23T12:10:36Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a5d340ca-144b-4241-9efb-9364737c5479","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-7cc2e5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-7cc2e5/rate-test-model-7cc2e5\",\"requestedSubscription\":\"e2e-rate-iso-a-15f56a\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-23T12:10:36Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a5d340ca-144b-4241-9efb-9364737c5479","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7cc2e5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-7cc2e5","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-15f56a","namespace":"ai-tenant-e2e-shared-a-7cc2e5","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-7cc2e5/rate-test-model-7cc2e5"}}
{"level":"debug","ts":"2026-07-23T12:10:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"a5d340ca-144b-4241-9efb-9364737c5479","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-23T12:10:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a5d340ca-144b-4241-9efb-9364737c5479","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T12:10:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a5d340ca-144b-4241-9efb-9364737c5479","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T12:10:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a5d340ca-144b-4241-9efb-9364737c5479","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T12:10:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a5d340ca-144b-4241-9efb-9364737c5479","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-7cc2e5/rate-test-model-7cc2e5\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-7cc2e5/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T12:10:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a5d340ca-144b-4241-9efb-9364737c5479","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-23T12:10:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a5d340ca-144b-4241-9efb-9364737c5479","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-23T12:10:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a5d340ca-144b-4241-9efb-9364737c5479","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-15f56a"}
{"level":"debug","ts":"2026-07-23T12:10:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a5d340ca-144b-4241-9efb-9364737c5479","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"60486649-1552-4206-9405-7b2b6f9840f3","keyName":"e2e-rate-a-15f56a","selected_subscription":"e2e-rate-iso-a-15f56a","selected_subscription_key":"ai-tenant-e2e-shared-a-7cc2e5/e2e-rate-iso-a-15f56a@ai-tenant-e2e-shared-a-7cc2e5/rate-test-model-7cc2e5","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-7cc2e5","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-15f56a","namespace":"ai-tenant-e2e-shared-a-7cc2e5","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-7cc2e5/rate-test-model-7cc2e5"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-23T12:10:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a5d340ca-144b-4241-9efb-9364737c5479","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-23T12:10:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a5d340ca-144b-4241-9efb-9364737c5479","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-23T12:10:44Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"46e1e8f9-8f31-43ce-9c23-83cb67dce6c5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:33118","PortSpecifier":{"PortValue":33118}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.79:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"46e1e8f9-8f31-43ce-9c23-83cb67dce6c5","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-7cc2e5.apps.df24a0d5-18ed-42c5-8ad0-608660f19de8.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-23T12:10:44Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"46e1e8f9-8f31-43ce-9c23-83cb67dce6c5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:33118","PortSpecifier":{"PortValue":33118}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.79:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784808644,"nanos":870029008},"http":{"id":"46e1e8f9-8f31-43ce-9c23-83cb67dce6c5","method":"POST","headers":{":authority":"e2e-shared-a-7cc2e5.apps.df24a0d5-18ed-42c5-8ad0-608660f19de8.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-23T12:10:44Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"46e1e8f9-8f31-43ce-9c23-83cb67dce6c5","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-23T12:10:44Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"46e1e8f9-8f31-43ce-9c23-83cb67dce6c5","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"5ef4894a-e528-4c9e-8d31-05017ccb6d4d","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=6628e0a3-15e5-4e8e-a44b-049958b54524"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/608660f19de8"]}}
{"level":"debug","ts":"2026-07-23T12:10:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"46e1e8f9-8f31-43ce-9c23-83cb67dce6c5","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/608660f19de8"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=6628e0a3-15e5-4e8e-a44b-049958b54524"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"5ef4894a-e528-4c9e-8d31-05017ccb6d4d","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"dbae7e17e6ca91fa930c462181959d5c386e4efd387f348d4c2b92298d449d2e"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.79:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-7cc2e5.apps.df24a0d5-18ed-42c5-8ad0-608660f19de8.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-23T12:10:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"46e1e8f9-8f31-43ce-9c23-83cb67dce6c5","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T12:10:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"46e1e8f9-8f31-43ce-9c23-83cb67dce6c5","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T12:10:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"46e1e8f9-8f31-43ce-9c23-83cb67dce6c5","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-7cc2e5/rate-test-model-7cc2e5\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-7cc2e5/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T12:10:44Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"46e1e8f9-8f31-43ce-9c23-83cb67dce6c5","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-23T12:10:44Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"46e1e8f9-8f31-43ce-9c23-83cb67dce6c5","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-23T12:10:44Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"46e1e8f9-8f31-43ce-9c23-83cb67dce6c5","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-23T12:10:44Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"46e1e8f9-8f31-43ce-9c23-83cb67dce6c5","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-23T12:10:44Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"46e1e8f9-8f31-43ce-9c23-83cb67dce6c5","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-23T12:10:44Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9bb479bb-3311-4966-8a18-2946e9df56a5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:41924","PortSpecifier":{"PortValue":41924}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.80:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"9bb479bb-3311-4966-8a18-2946e9df56a5","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-77f87c.apps.df24a0d5-18ed-42c5-8ad0-608660f19de8.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-23T12:10:44Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"9bb479bb-3311-4966-8a18-2946e9df56a5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:41924","PortSpecifier":{"PortValue":41924}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.80:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784808644,"nanos":909647095},"http":{"id":"9bb479bb-3311-4966-8a18-2946e9df56a5","method":"POST","headers":{":authority":"e2e-shared-b-77f87c.apps.df24a0d5-18ed-42c5-8ad0-608660f19de8.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-23T12:10:44Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"9bb479bb-3311-4966-8a18-2946e9df56a5","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-23T12:10:44Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"9bb479bb-3311-4966-8a18-2946e9df56a5","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"5ef4894a-e528-4c9e-8d31-05017ccb6d4d","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=6628e0a3-15e5-4e8e-a44b-049958b54524"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/608660f19de8"]}}
{"level":"debug","ts":"2026-07-23T12:10:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"9bb479bb-3311-4966-8a18-2946e9df56a5","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/608660f19de8"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=6628e0a3-15e5-4e8e-a44b-049958b54524"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"5ef4894a-e528-4c9e-8d31-05017ccb6d4d","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"8b43513434d2697dc726c90e28098eea55536ec772f2b236d2aa36149df0f068"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.80:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-77f87c.apps.df24a0d5-18ed-42c5-8ad0-608660f19de8.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-23T12:10:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9bb479bb-3311-4966-8a18-2946e9df56a5","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T12:10:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9bb479bb-3311-4966-8a18-2946e9df56a5","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T12:10:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"9bb479bb-3311-4966-8a18-2946e9df56a5","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-77f87c/rate-test-model-77f87c\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-77f87c/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T12:10:44Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"9bb479bb-3311-4966-8a18-2946e9df56a5","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"groups","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-23T12:10:44Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9bb479bb-3311-4966-8a18-2946e9df56a5","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-23T12:10:44Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"9bb479bb-3311-4966-8a18-2946e9df56a5","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-23T12:10:44Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9bb479bb-3311-4966-8a18-2946e9df56a5","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-23T12:10:44Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"9bb479bb-3311-4966-8a18-2946e9df56a5","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-23T12:10:44Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"dbf93d2e-2fb6-4998-a4ab-b8a06e937855","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:33120","PortSpecifier":{"PortValue":33120}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.79:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"dbf93d2e-2fb6-4998-a4ab-b8a06e937855","method":"POST","path":"/ai-tenant-e2e-shared-a-7cc2e5/rate-test-model-7cc2e5/v1/completions","host":"e2e-shared-a-7cc2e5.apps.df24a0d5-18ed-42c5-8ad0-608660f19de8.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-23T12:10:44Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"dbf93d2e-2fb6-4998-a4ab-b8a06e937855","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:33120","PortSpecifier":{"PortValue":33120}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.79:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784808644,"nanos":941924360},"http":{"id":"dbf93d2e-2fb6-4998-a4ab-b8a06e937855","method":"POST","headers":{":authority":"e2e-shared-a-7cc2e5.apps.df24a0d5-18ed-42c5-8ad0-608660f19de8.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-7cc2e5/rate-test-model-7cc2e5/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-23T12:10:44Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"dbf93d2e-2fb6-4998-a4ab-b8a06e937855","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-taKEpCilUczWrGrR_pn5O6zcakEZgRHK5e8O4xzbqwI26TFURfY8OU4j8RxC"}
{"level":"debug","ts":"2026-07-23T12:10:44Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"dbf93d2e-2fb6-4998-a4ab-b8a06e937855","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-7cc2e5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-taKEpCilUczWrGrR_pn5O6zcakEZgRHK5e8O4xzbqwI26TFURfY8OU4j8RxC\"}"}
{"level":"debug","ts":"2026-07-23T12:10:44Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"dbf93d2e-2fb6-4998-a4ab-b8a06e937855","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7cc2e5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"f5f27ce2-0380-4cb9-ae16-124f17f8475d","keyName":"e2e-rate-a-9466a9","subscription":"e2e-rate-iso-a-9466a9","tenant":"e2e-shared-a-7cc2e5","userId":"f5f27ce2-0380-4cb9-ae16-124f17f8475d","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-23T12:10:44Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"dbf93d2e-2fb6-4998-a4ab-b8a06e937855","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-7cc2e5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-7cc2e5/rate-test-model-7cc2e5\",\"requestedSubscription\":\"e2e-rate-iso-a-9466a9\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-23T12:10:44Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"dbf93d2e-2fb6-4998-a4ab-b8a06e937855","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7cc2e5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-7cc2e5","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-9466a9","namespace":"ai-tenant-e2e-shared-a-7cc2e5","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-7cc2e5/rate-test-model-7cc2e5"}}
{"level":"debug","ts":"2026-07-23T12:10:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"dbf93d2e-2fb6-4998-a4ab-b8a06e937855","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-23T12:10:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"dbf93d2e-2fb6-4998-a4ab-b8a06e937855","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T12:10:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"dbf93d2e-2fb6-4998-a4ab-b8a06e937855","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T12:10:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"dbf93d2e-2fb6-4998-a4ab-b8a06e937855","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-7cc2e5/rate-test-model-7cc2e5\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-7cc2e5/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T12:10:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"dbf93d2e-2fb6-4998-a4ab-b8a06e937855","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T12:10:44Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"dbf93d2e-2fb6-4998-a4ab-b8a06e937855","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-9466a9"}
{"level":"debug","ts":"2026-07-23T12:10:44Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"dbf93d2e-2fb6-4998-a4ab-b8a06e937855","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-23T12:10:44Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"dbf93d2e-2fb6-4998-a4ab-b8a06e937855","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-23T12:10:44Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"dbf93d2e-2fb6-4998-a4ab-b8a06e937855","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"f5f27ce2-0380-4cb9-ae16-124f17f8475d","keyName":"e2e-rate-a-9466a9","selected_subscription":"e2e-rate-iso-a-9466a9","selected_subscription_key":"ai-tenant-e2e-shared-a-7cc2e5/e2e-rate-iso-a-9466a9@ai-tenant-e2e-shared-a-7cc2e5/rate-test-model-7cc2e5","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-7cc2e5","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-9466a9","namespace":"ai-tenant-e2e-shared-a-7cc2e5","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-7cc2e5/rate-test-model-7cc2e5"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-23T12:10:44Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"dbf93d2e-2fb6-4998-a4ab-b8a06e937855","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-23T12:10:44Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"dbf93d2e-2fb6-4998-a4ab-b8a06e937855","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-23T12:10:45Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8a773918-dccf-4893-b580-5ba9e4286074","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:33128","PortSpecifier":{"PortValue":33128}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.79:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"8a773918-dccf-4893-b580-5ba9e4286074","method":"POST","path":"/ai-tenant-e2e-shared-a-7cc2e5/rate-test-model-7cc2e5/v1/completions","host":"e2e-shared-a-7cc2e5.apps.df24a0d5-18ed-42c5-8ad0-608660f19de8.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-23T12:10:45Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8a773918-dccf-4893-b580-5ba9e4286074","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:33128","PortSpecifier":{"PortValue":33128}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.79:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784808645,"nanos":974322863},"http":{"id":"8a773918-dccf-4893-b580-5ba9e4286074","method":"POST","headers":{":authority":"e2e-shared-a-7cc2e5.apps.df24a0d5-18ed-42c5-8ad0-608660f19de8.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-7cc2e5/rate-test-model-7cc2e5/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-23T12:10:45Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"8a773918-dccf-4893-b580-5ba9e4286074","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-taKEpCilUczWrGrR_pn5O6zcakEZgRHK5e8O4xzbqwI26TFURfY8OU4j8RxC"}
{"level":"debug","ts":"2026-07-23T12:10:45Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"8a773918-dccf-4893-b580-5ba9e4286074","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-7cc2e5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-taKEpCilUczWrGrR_pn5O6zcakEZgRHK5e8O4xzbqwI26TFURfY8OU4j8RxC\"}"}
{"level":"debug","ts":"2026-07-23T12:10:45Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"8a773918-dccf-4893-b580-5ba9e4286074","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7cc2e5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"f5f27ce2-0380-4cb9-ae16-124f17f8475d","keyName":"e2e-rate-a-9466a9","subscription":"e2e-rate-iso-a-9466a9","tenant":"e2e-shared-a-7cc2e5","userId":"f5f27ce2-0380-4cb9-ae16-124f17f8475d","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-23T12:10:45Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"8a773918-dccf-4893-b580-5ba9e4286074","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-7cc2e5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-7cc2e5/rate-test-model-7cc2e5\",\"requestedSubscription\":\"e2e-rate-iso-a-9466a9\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-23T12:10:45Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"8a773918-dccf-4893-b580-5ba9e4286074","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7cc2e5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-7cc2e5","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-9466a9","namespace":"ai-tenant-e2e-shared-a-7cc2e5","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-7cc2e5/rate-test-model-7cc2e5"}}
{"level":"debug","ts":"2026-07-23T12:10:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"8a773918-dccf-4893-b580-5ba9e4286074","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-23T12:10:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8a773918-dccf-4893-b580-5ba9e4286074","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T12:10:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8a773918-dccf-4893-b580-5ba9e4286074","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T12:10:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8a773918-dccf-4893-b580-5ba9e4286074","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-7cc2e5/rate-test-model-7cc2e5\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-7cc2e5/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T12:10:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8a773918-dccf-4893-b580-5ba9e4286074","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T12:10:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8a773918-dccf-4893-b580-5ba9e4286074","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-9466a9"}
{"level":"debug","ts":"2026-07-23T12:10:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8a773918-dccf-4893-b580-5ba9e4286074","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-23T12:10:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8a773918-dccf-4893-b580-5ba9e4286074","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-23T12:10:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8a773918-dccf-4893-b580-5ba9e4286074","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"f5f27ce2-0380-4cb9-ae16-124f17f8475d","keyName":"e2e-rate-a-9466a9","selected_subscription":"e2e-rate-iso-a-9466a9","selected_subscription_key":"ai-tenant-e2e-shared-a-7cc2e5/e2e-rate-iso-a-9466a9@ai-tenant-e2e-shared-a-7cc2e5/rate-test-model-7cc2e5","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-7cc2e5","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-9466a9","namespace":"ai-tenant-e2e-shared-a-7cc2e5","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-7cc2e5/rate-test-model-7cc2e5"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-23T12:10:45Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8a773918-dccf-4893-b580-5ba9e4286074","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-23T12:10:45Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8a773918-dccf-4893-b580-5ba9e4286074","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-23T12:10:47Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"fc6b7524-a66a-42b5-96ab-5d0a1086287f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:33142","PortSpecifier":{"PortValue":33142}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.79:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"fc6b7524-a66a-42b5-96ab-5d0a1086287f","method":"POST","path":"/ai-tenant-e2e-shared-a-7cc2e5/rate-test-model-7cc2e5/v1/completions","host":"e2e-shared-a-7cc2e5.apps.df24a0d5-18ed-42c5-8ad0-608660f19de8.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-23T12:10:47Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"fc6b7524-a66a-42b5-96ab-5d0a1086287f","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:33142","PortSpecifier":{"PortValue":33142}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.79:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784808647,"nanos":8617319},"http":{"id":"fc6b7524-a66a-42b5-96ab-5d0a1086287f","method":"POST","headers":{":authority":"e2e-shared-a-7cc2e5.apps.df24a0d5-18ed-42c5-8ad0-608660f19de8.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-7cc2e5/rate-test-model-7cc2e5/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-23T12:10:47Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"fc6b7524-a66a-42b5-96ab-5d0a1086287f","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-taKEpCilUczWrGrR_pn5O6zcakEZgRHK5e8O4xzbqwI26TFURfY8OU4j8RxC"}
{"level":"debug","ts":"2026-07-23T12:10:47Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"fc6b7524-a66a-42b5-96ab-5d0a1086287f","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-7cc2e5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-taKEpCilUczWrGrR_pn5O6zcakEZgRHK5e8O4xzbqwI26TFURfY8OU4j8RxC\"}"}
{"level":"debug","ts":"2026-07-23T12:10:47Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"fc6b7524-a66a-42b5-96ab-5d0a1086287f","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7cc2e5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"f5f27ce2-0380-4cb9-ae16-124f17f8475d","keyName":"e2e-rate-a-9466a9","subscription":"e2e-rate-iso-a-9466a9","tenant":"e2e-shared-a-7cc2e5","userId":"f5f27ce2-0380-4cb9-ae16-124f17f8475d","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-23T12:10:47Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"fc6b7524-a66a-42b5-96ab-5d0a1086287f","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-7cc2e5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-7cc2e5/rate-test-model-7cc2e5\",\"requestedSubscription\":\"e2e-rate-iso-a-9466a9\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-23T12:10:47Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"fc6b7524-a66a-42b5-96ab-5d0a1086287f","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-7cc2e5.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-7cc2e5","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-9466a9","namespace":"ai-tenant-e2e-shared-a-7cc2e5","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-7cc2e5/rate-test-model-7cc2e5"}}
{"level":"debug","ts":"2026-07-23T12:10:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"fc6b7524-a66a-42b5-96ab-5d0a1086287f","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-23T12:10:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fc6b7524-a66a-42b5-96ab-5d0a1086287f","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T12:10:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fc6b7524-a66a-42b5-96ab-5d0a1086287f","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T12:10:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fc6b7524-a66a-42b5-96ab-5d0a1086287f","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T12:10:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fc6b7524-a66a-42b5-96ab-5d0a1086287f","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-7cc2e5/rate-test-model-7cc2e5\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-7cc2e5/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T12:10:47Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"fc6b7524-a66a-42b5-96ab-5d0a1086287f","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-23T12:10:47Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"fc6b7524-a66a-42b5-96ab-5d0a1086287f","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-9466a9"}
{"level":"debug","ts":"2026-07-23T12:10:47Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"fc6b7524-a66a-42b5-96ab-5d0a1086287f","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-23T12:10:47Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"fc6b7524-a66a-42b5-96ab-5d0a1086287f","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"f5f27ce2-0380-4cb9-ae16-124f17f8475d","keyName":"e2e-rate-a-9466a9","selected_subscription":"e2e-rate-iso-a-9466a9","selected_subscription_key":"ai-tenant-e2e-shared-a-7cc2e5/e2e-rate-iso-a-9466a9@ai-tenant-e2e-shared-a-7cc2e5/rate-test-model-7cc2e5","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-7cc2e5","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-9466a9","namespace":"ai-tenant-e2e-shared-a-7cc2e5","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-7cc2e5/rate-test-model-7cc2e5"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-23T12:10:47Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"fc6b7524-a66a-42b5-96ab-5d0a1086287f","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-23T12:10:47Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"fc6b7524-a66a-42b5-96ab-5d0a1086287f","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-23T12:10:47Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"df93fdb0-d79f-4fba-b2da-104082d15993","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:41936","PortSpecifier":{"PortValue":41936}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.80:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"df93fdb0-d79f-4fba-b2da-104082d15993","method":"POST","path":"/ai-tenant-e2e-shared-b-77f87c/rate-test-model-77f87c/v1/completions","host":"e2e-shared-b-77f87c.apps.df24a0d5-18ed-42c5-8ad0-608660f19de8.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-23T12:10:47Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"df93fdb0-d79f-4fba-b2da-104082d15993","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.16:41936","PortSpecifier":{"PortValue":41936}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.80:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1784808647,"nanos":54421698},"http":{"id":"df93fdb0-d79f-4fba-b2da-104082d15993","method":"POST","headers":{":authority":"e2e-shared-b-77f87c.apps.df24a0d5-18ed-42c5-8ad0-608660f19de8.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-b-77f87c/rate-test-model-77f87c/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-23T12:10:47Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"df93fdb0-d79f-4fba-b2da-104082d15993","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-f95Ylr0ivrFo6Zrw_hxZZ7ftmsrg5Dmdt5FrRHBc08bhAzmq7bVUFS4WSOd5"}
{"level":"debug","ts":"2026-07-23T12:10:47Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"df93fdb0-d79f-4fba-b2da-104082d15993","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-b-77f87c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-f95Ylr0ivrFo6Zrw_hxZZ7ftmsrg5Dmdt5FrRHBc08bhAzmq7bVUFS4WSOd5\"}"}
{"level":"debug","ts":"2026-07-23T12:10:47Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"df93fdb0-d79f-4fba-b2da-104082d15993","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-77f87c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"865fb8a1-e560-4bd1-8781-15457b0e5cc3","keyName":"e2e-rate-b-9466a9","subscription":"e2e-rate-iso-b-9466a9","tenant":"e2e-shared-b-77f87c","userId":"865fb8a1-e560-4bd1-8781-15457b0e5cc3","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-23T12:10:47Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"df93fdb0-d79f-4fba-b2da-104082d15993","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-b-77f87c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-b-77f87c/rate-test-model-77f87c\",\"requestedSubscription\":\"e2e-rate-iso-b-9466a9\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-23T12:10:47Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"df93fdb0-d79f-4fba-b2da-104082d15993","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-77f87c.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-77f87c","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-9466a9","namespace":"ai-tenant-e2e-shared-b-77f87c","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-b-77f87c/rate-test-model-77f87c"}}
{"level":"debug","ts":"2026-07-23T12:10:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"df93fdb0-d79f-4fba-b2da-104082d15993","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-23T12:10:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"df93fdb0-d79f-4fba-b2da-104082d15993","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T12:10:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"df93fdb0-d79f-4fba-b2da-104082d15993","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T12:10:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"df93fdb0-d79f-4fba-b2da-104082d15993","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-77f87c/rate-test-model-77f87c\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-77f87c/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T12:10:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"df93fdb0-d79f-4fba-b2da-104082d15993","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-23T12:10:47Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"df93fdb0-d79f-4fba-b2da-104082d15993","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-23T12:10:47Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"df93fdb0-d79f-4fba-b2da-104082d15993","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-23T12:10:47Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"df93fdb0-d79f-4fba-b2da-104082d15993","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-b-9466a9"}
{"level":"debug","ts":"2026-07-23T12:10:47Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"df93fdb0-d79f-4fba-b2da-104082d15993","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"865fb8a1-e560-4bd1-8781-15457b0e5cc3","keyName":"e2e-rate-b-9466a9","selected_subscription":"e2e-rate-iso-b-9466a9","selected_subscription_key":"ai-tenant-e2e-shared-b-77f87c/e2e-rate-iso-b-9466a9@ai-tenant-e2e-shared-b-77f87c/rate-test-model-77f87c","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-77f87c","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-9466a9","namespace":"ai-tenant-e2e-shared-b-77f87c","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-b-77f87c/rate-test-model-77f87c"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-23T12:10:47Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"df93fdb0-d79f-4fba-b2da-104082d15993","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-23T12:10:47Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"df93fdb0-d79f-4fba-b2da-104082d15993","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-23T12:10:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/2b45a3b0d7b135044912b7b6f1a854ecc356a3b893c3be84d8871cc5f3126268"}
{"level":"info","ts":"2026-07-23T12:10:53Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/dbae7e17e6ca91fa930c462181959d5c386e4efd387f348d4c2b92298d449d2e"}
{"level":"info","ts":"2026-07-23T12:10:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/2ffe42d10c53a9ad99e367b0783901287cd745a2cfa2235cbc21d6d71ce348c0"}
{"level":"info","ts":"2026-07-23T12:10:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/8afc556fbda3c92f1513f8bbca03c47e8e3305fe20b62d6c7b046a1f8fd665f6"}
{"level":"info","ts":"2026-07-23T12:10:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/0bcadb8aa503d40ba4e1c66d478593e1d6a424a1f212bfea62a6b105160a0409"}
{"level":"info","ts":"2026-07-23T12:10:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/285f41b9a5f4fe7e6635498e3fd563b4d6f4c0f21d38f805755be53d38f12b75"}
{"level":"info","ts":"2026-07-23T12:10:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/18a59432af0e78c9b1bfb912f0ea78438ac44c50732852e647d68ddedd009d6d"}
{"level":"info","ts":"2026-07-23T12:10:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/854a589da4137d712f467e7aa12f1ec2dbb840af4e49d040f8ab6de8741f6854"}
{"level":"info","ts":"2026-07-23T12:10:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/52ba7ccae2a9fcf79466a8818ea2921622a6a48e235d25d68fc1ab61b5456fab"}
{"level":"info","ts":"2026-07-23T12:10:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/8b43513434d2697dc726c90e28098eea55536ec772f2b236d2aa36149df0f068"}
{"level":"info","ts":"2026-07-23T12:10:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/8a3506ff2caaf06e30de7d65e03b2c6219c22dda5c5f406194b78d14e999bd25"}
{"level":"info","ts":"2026-07-23T12:10:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/d5e91dfd57cda145450a896cb13ba9ec5bc9b02905309d3f040c6861afd2c5c0"}
{"level":"info","ts":"2026-07-23T12:10:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/76bfb1bfcd6e59a13edb559fcdac15f670326082ec68746f16d920db5c446626"}
{"level":"info","ts":"2026-07-23T12:10:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/8579d27dba9d2501b729b7268a3c39e68ad30f0235b3a2790a4a8b1ea4821b25"}
{"level":"info","ts":"2026-07-23T12:10:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/26100e9ad5b2570f823a795bf302afa5025042363e08510444f9eb505a6113d3"}
{"level":"info","ts":"2026-07-23T12:10:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/141f78c990d0a9647ed2ba27d1aa9957d1944666cb0919d24eae763f41343dfb"}
{"level":"info","ts":"2026-07-23T12:10:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/b881693c087074f26f875ad5a251bcfa756e1f04988d08d3cde118b29fe09fe5"}
{"level":"info","ts":"2026-07-23T12:10:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/167fd8ab596e88eca4d79bde2dab2fea1371cbce14d16e3625b8fe15ff8c51d0"}
{"level":"info","ts":"2026-07-23T12:10:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/b96f5e48c2e9e74de26ddd5fc2213d036716d9c79caefcb587ec76ceee4b7d46"}
{"level":"info","ts":"2026-07-23T12:10:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/310669938e8914e6285c9258ffb04edc82d93bd0a25facea679f834967b7fb6c"}
{"level":"info","ts":"2026-07-23T12:10:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/2b9877281f28c945222a79c1aedbc369832226edb79c4e1130297b58a2622863"}
{"level":"info","ts":"2026-07-23T12:10:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/91ff65466604b48b00e17894964b591a2864ec656863d631725c2ba55b7edbf7"}
{"level":"info","ts":"2026-07-23T12:10:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/971135a5fcf29b26ac81569c66f777b249ae7fbac8d473611e1edb607bd0bb30"}
{"level":"info","ts":"2026-07-23T12:10:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/ffc3ea9478530db1ebce7b1de910bca85bf3a9ab93a5b0243845c343912db4a9"}