{"level":"info","ts":"2026-07-07T17:47:18Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1711770c354883dcc1cb93d0d03a753703b46da1c1ce46eeb1a2bda55e55b4dd"}
{"level":"debug","ts":"2026-07-07T17:47:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e0f8e20e049197b76ebeac4abe24f913efd1e862a1a1ff6ba439b4ecc04dfe06","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-07T17:47:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e0f8e20e049197b76ebeac4abe24f913efd1e862a1a1ff6ba439b4ecc04dfe06"}
{"level":"debug","ts":"2026-07-07T17:47:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"322586a5dae66b6b4722626aec3cbf7c7ce9b94039e8b76acef1b27f27b7b0f2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-07T17:47:19Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-07T17:47:19Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-07T17:47:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"322586a5dae66b6b4722626aec3cbf7c7ce9b94039e8b76acef1b27f27b7b0f2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T17:47:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"322586a5dae66b6b4722626aec3cbf7c7ce9b94039e8b76acef1b27f27b7b0f2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T17:47:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"322586a5dae66b6b4722626aec3cbf7c7ce9b94039e8b76acef1b27f27b7b0f2","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-07T17:47:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/322586a5dae66b6b4722626aec3cbf7c7ce9b94039e8b76acef1b27f27b7b0f2"}
{"level":"debug","ts":"2026-07-07T17:47:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"322586a5dae66b6b4722626aec3cbf7c7ce9b94039e8b76acef1b27f27b7b0f2","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-07T17:47:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/322586a5dae66b6b4722626aec3cbf7c7ce9b94039e8b76acef1b27f27b7b0f2"}
{"level":"debug","ts":"2026-07-07T17:47:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c1e7b3a36be8c501c2188990da07a0ec67d60ec50ce7566c918eb44876872137","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T17:47:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"322586a5dae66b6b4722626aec3cbf7c7ce9b94039e8b76acef1b27f27b7b0f2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-07T17:47:19Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-07T17:47:19Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["322586a5dae66b6b4722626aec3cbf7c7ce9b94039e8b76acef1b27f27b7b0f2"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-07T17:47:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c1e7b3a36be8c501c2188990da07a0ec67d60ec50ce7566c918eb44876872137"}
{"level":"info","ts":"2026-07-07T17:47:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"322586a5dae66b6b4722626aec3cbf7c7ce9b94039e8b76acef1b27f27b7b0f2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T17:47:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"322586a5dae66b6b4722626aec3cbf7c7ce9b94039e8b76acef1b27f27b7b0f2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-07T17:47:19Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-07T17:47:19Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-07T17:47:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"322586a5dae66b6b4722626aec3cbf7c7ce9b94039e8b76acef1b27f27b7b0f2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T17:47:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"322586a5dae66b6b4722626aec3cbf7c7ce9b94039e8b76acef1b27f27b7b0f2","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-07T17:47:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/322586a5dae66b6b4722626aec3cbf7c7ce9b94039e8b76acef1b27f27b7b0f2"}
{"level":"debug","ts":"2026-07-07T17:47:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"322586a5dae66b6b4722626aec3cbf7c7ce9b94039e8b76acef1b27f27b7b0f2","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-07T17:47:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/322586a5dae66b6b4722626aec3cbf7c7ce9b94039e8b76acef1b27f27b7b0f2"}
{"level":"debug","ts":"2026-07-07T17:47:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"322586a5dae66b6b4722626aec3cbf7c7ce9b94039e8b76acef1b27f27b7b0f2","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-07T17:47:19Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-07T17:47:19Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["322586a5dae66b6b4722626aec3cbf7c7ce9b94039e8b76acef1b27f27b7b0f2"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-07T17:47:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"322586a5dae66b6b4722626aec3cbf7c7ce9b94039e8b76acef1b27f27b7b0f2","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T17:47:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"31d806710f35ce7ff75094aab8c317a486fcc45cef199a7196efeaddfad777ef","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T17:47:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"322586a5dae66b6b4722626aec3cbf7c7ce9b94039e8b76acef1b27f27b7b0f2","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-07T17:47:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/31d806710f35ce7ff75094aab8c317a486fcc45cef199a7196efeaddfad777ef"}
{"level":"info","ts":"2026-07-07T17:47:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/322586a5dae66b6b4722626aec3cbf7c7ce9b94039e8b76acef1b27f27b7b0f2"}
{"level":"debug","ts":"2026-07-07T17:47:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1c50221d222fb7b8ff4e11098df6b62d7b0c78ec2bc8847434de1ac76313f7c8","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-07T17:47:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1c50221d222fb7b8ff4e11098df6b62d7b0c78ec2bc8847434de1ac76313f7c8"}
{"level":"debug","ts":"2026-07-07T17:47:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"cde74f5de53e77d196a3aabf0abe3ce1507be42659b509a031e6951a70eae6ed","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-07T17:47:19Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-07T17:47:19Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-07T17:47:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"cde74f5de53e77d196a3aabf0abe3ce1507be42659b509a031e6951a70eae6ed","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T17:47:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"cde74f5de53e77d196a3aabf0abe3ce1507be42659b509a031e6951a70eae6ed","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-07T17:47:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/cde74f5de53e77d196a3aabf0abe3ce1507be42659b509a031e6951a70eae6ed"}
{"level":"debug","ts":"2026-07-07T17:47:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"cde74f5de53e77d196a3aabf0abe3ce1507be42659b509a031e6951a70eae6ed","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T17:47:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"cde74f5de53e77d196a3aabf0abe3ce1507be42659b509a031e6951a70eae6ed","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-07T17:47:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/cde74f5de53e77d196a3aabf0abe3ce1507be42659b509a031e6951a70eae6ed"}
{"level":"debug","ts":"2026-07-07T17:47:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"cde74f5de53e77d196a3aabf0abe3ce1507be42659b509a031e6951a70eae6ed","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-07T17:47:19Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-07T17:47:19Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["cde74f5de53e77d196a3aabf0abe3ce1507be42659b509a031e6951a70eae6ed"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-07T17:47:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"cde74f5de53e77d196a3aabf0abe3ce1507be42659b509a031e6951a70eae6ed","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T17:47:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"597c93ad52d13f8f9546c1f288952a470b1cbaa119def99c8ff4f25164de8787","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-07T17:47:19Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-07T17:47:19Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-07T17:47:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/597c93ad52d13f8f9546c1f288952a470b1cbaa119def99c8ff4f25164de8787"}
{"level":"info","ts":"2026-07-07T17:47:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"597c93ad52d13f8f9546c1f288952a470b1cbaa119def99c8ff4f25164de8787","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T17:47:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"cde74f5de53e77d196a3aabf0abe3ce1507be42659b509a031e6951a70eae6ed","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-07T17:47:19Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-07T17:47:19Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-07T17:47:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/cde74f5de53e77d196a3aabf0abe3ce1507be42659b509a031e6951a70eae6ed"}
{"level":"info","ts":"2026-07-07T17:47:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"cde74f5de53e77d196a3aabf0abe3ce1507be42659b509a031e6951a70eae6ed","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T17:47:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"597c93ad52d13f8f9546c1f288952a470b1cbaa119def99c8ff4f25164de8787","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T17:47:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"cde74f5de53e77d196a3aabf0abe3ce1507be42659b509a031e6951a70eae6ed","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-07T17:47:19Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-07T17:47:19Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["cde74f5de53e77d196a3aabf0abe3ce1507be42659b509a031e6951a70eae6ed"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-07T17:47:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/597c93ad52d13f8f9546c1f288952a470b1cbaa119def99c8ff4f25164de8787"}
{"level":"info","ts":"2026-07-07T17:47:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"cde74f5de53e77d196a3aabf0abe3ce1507be42659b509a031e6951a70eae6ed","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T17:47:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"597c93ad52d13f8f9546c1f288952a470b1cbaa119def99c8ff4f25164de8787","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-07T17:47:19Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-07T17:47:19Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["597c93ad52d13f8f9546c1f288952a470b1cbaa119def99c8ff4f25164de8787"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-07T17:47:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/cde74f5de53e77d196a3aabf0abe3ce1507be42659b509a031e6951a70eae6ed"}
{"level":"info","ts":"2026-07-07T17:47:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"597c93ad52d13f8f9546c1f288952a470b1cbaa119def99c8ff4f25164de8787","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T17:47:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"cde74f5de53e77d196a3aabf0abe3ce1507be42659b509a031e6951a70eae6ed","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-07T17:47:19Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-07T17:47:19Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-07T17:47:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/cde74f5de53e77d196a3aabf0abe3ce1507be42659b509a031e6951a70eae6ed"}
{"level":"info","ts":"2026-07-07T17:47:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"cde74f5de53e77d196a3aabf0abe3ce1507be42659b509a031e6951a70eae6ed","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T17:47:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"597c93ad52d13f8f9546c1f288952a470b1cbaa119def99c8ff4f25164de8787","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-07T17:47:19Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-07T17:47:19Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-07T17:47:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/597c93ad52d13f8f9546c1f288952a470b1cbaa119def99c8ff4f25164de8787"}
{"level":"info","ts":"2026-07-07T17:47:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"597c93ad52d13f8f9546c1f288952a470b1cbaa119def99c8ff4f25164de8787","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T17:47:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"cde74f5de53e77d196a3aabf0abe3ce1507be42659b509a031e6951a70eae6ed","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T17:47:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"597c93ad52d13f8f9546c1f288952a470b1cbaa119def99c8ff4f25164de8787","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-07T17:47:19Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-07T17:47:19Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["597c93ad52d13f8f9546c1f288952a470b1cbaa119def99c8ff4f25164de8787"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-07T17:47:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/cde74f5de53e77d196a3aabf0abe3ce1507be42659b509a031e6951a70eae6ed"}
{"level":"info","ts":"2026-07-07T17:47:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"597c93ad52d13f8f9546c1f288952a470b1cbaa119def99c8ff4f25164de8787","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T17:47:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"cde74f5de53e77d196a3aabf0abe3ce1507be42659b509a031e6951a70eae6ed","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-07T17:47:19Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-07T17:47:19Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["cde74f5de53e77d196a3aabf0abe3ce1507be42659b509a031e6951a70eae6ed"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-07T17:47:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/597c93ad52d13f8f9546c1f288952a470b1cbaa119def99c8ff4f25164de8787"}
{"level":"info","ts":"2026-07-07T17:47:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"cde74f5de53e77d196a3aabf0abe3ce1507be42659b509a031e6951a70eae6ed","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T17:47:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"597c93ad52d13f8f9546c1f288952a470b1cbaa119def99c8ff4f25164de8787","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-07T17:47:19Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-07T17:47:19Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-07T17:47:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/597c93ad52d13f8f9546c1f288952a470b1cbaa119def99c8ff4f25164de8787"}
{"level":"info","ts":"2026-07-07T17:47:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"597c93ad52d13f8f9546c1f288952a470b1cbaa119def99c8ff4f25164de8787","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T17:47:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"cde74f5de53e77d196a3aabf0abe3ce1507be42659b509a031e6951a70eae6ed","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-07T17:47:19Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-07T17:47:19Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-07T17:47:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/cde74f5de53e77d196a3aabf0abe3ce1507be42659b509a031e6951a70eae6ed"}
{"level":"info","ts":"2026-07-07T17:47:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"cde74f5de53e77d196a3aabf0abe3ce1507be42659b509a031e6951a70eae6ed","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T17:47:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7fe0d80bd3060a4b116a3a1e875b9e1424fb9f3ad1889f2b6600d7b98ab0cfe1","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-07T17:47:19Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-07T17:47:19Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-07T17:47:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7fe0d80bd3060a4b116a3a1e875b9e1424fb9f3ad1889f2b6600d7b98ab0cfe1"}
{"level":"info","ts":"2026-07-07T17:47:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7fe0d80bd3060a4b116a3a1e875b9e1424fb9f3ad1889f2b6600d7b98ab0cfe1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T17:47:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"597c93ad52d13f8f9546c1f288952a470b1cbaa119def99c8ff4f25164de8787","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T17:47:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"cde74f5de53e77d196a3aabf0abe3ce1507be42659b509a031e6951a70eae6ed","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-07T17:47:19Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-07T17:47:19Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["cde74f5de53e77d196a3aabf0abe3ce1507be42659b509a031e6951a70eae6ed"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-07T17:47:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/597c93ad52d13f8f9546c1f288952a470b1cbaa119def99c8ff4f25164de8787"}
{"level":"info","ts":"2026-07-07T17:47:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"cde74f5de53e77d196a3aabf0abe3ce1507be42659b509a031e6951a70eae6ed","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T17:47:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7fe0d80bd3060a4b116a3a1e875b9e1424fb9f3ad1889f2b6600d7b98ab0cfe1","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-07T17:47:19Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-07T17:47:19Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["7fe0d80bd3060a4b116a3a1e875b9e1424fb9f3ad1889f2b6600d7b98ab0cfe1"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-07T17:47:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/cde74f5de53e77d196a3aabf0abe3ce1507be42659b509a031e6951a70eae6ed"}
{"level":"info","ts":"2026-07-07T17:47:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7fe0d80bd3060a4b116a3a1e875b9e1424fb9f3ad1889f2b6600d7b98ab0cfe1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T17:47:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"597c93ad52d13f8f9546c1f288952a470b1cbaa119def99c8ff4f25164de8787","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-07T17:47:19Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-07T17:47:19Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["597c93ad52d13f8f9546c1f288952a470b1cbaa119def99c8ff4f25164de8787"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-07T17:47:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7fe0d80bd3060a4b116a3a1e875b9e1424fb9f3ad1889f2b6600d7b98ab0cfe1"}
{"level":"info","ts":"2026-07-07T17:47:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"597c93ad52d13f8f9546c1f288952a470b1cbaa119def99c8ff4f25164de8787","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T17:47:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"cde74f5de53e77d196a3aabf0abe3ce1507be42659b509a031e6951a70eae6ed","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-07T17:47:19Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-07T17:47:19Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-07T17:47:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/cde74f5de53e77d196a3aabf0abe3ce1507be42659b509a031e6951a70eae6ed"}
{"level":"info","ts":"2026-07-07T17:47:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"cde74f5de53e77d196a3aabf0abe3ce1507be42659b509a031e6951a70eae6ed","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T17:47:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7fe0d80bd3060a4b116a3a1e875b9e1424fb9f3ad1889f2b6600d7b98ab0cfe1","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-07T17:47:19Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-07T17:47:19Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-07T17:47:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7fe0d80bd3060a4b116a3a1e875b9e1424fb9f3ad1889f2b6600d7b98ab0cfe1"}
{"level":"info","ts":"2026-07-07T17:47:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7fe0d80bd3060a4b116a3a1e875b9e1424fb9f3ad1889f2b6600d7b98ab0cfe1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T17:47:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"597c93ad52d13f8f9546c1f288952a470b1cbaa119def99c8ff4f25164de8787","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-07T17:47:19Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-07T17:47:19Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-07T17:47:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"597c93ad52d13f8f9546c1f288952a470b1cbaa119def99c8ff4f25164de8787","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T17:47:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ee5c8259cb0c30598dbdb5dc2df20f5a44ba138c5da30bfe6cabf955e681707d","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T17:47:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"cde74f5de53e77d196a3aabf0abe3ce1507be42659b509a031e6951a70eae6ed","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-07T17:47:19Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-07T17:47:19Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["cde74f5de53e77d196a3aabf0abe3ce1507be42659b509a031e6951a70eae6ed"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-07T17:47:19Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/597c93ad52d13f8f9546c1f288952a470b1cbaa119def99c8ff4f25164de8787"}
{"level":"info","ts":"2026-07-07T17:47:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"cde74f5de53e77d196a3aabf0abe3ce1507be42659b509a031e6951a70eae6ed","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T17:47:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7fe0d80bd3060a4b116a3a1e875b9e1424fb9f3ad1889f2b6600d7b98ab0cfe1","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-07T17:47:20Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-07T17:47:20Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["7fe0d80bd3060a4b116a3a1e875b9e1424fb9f3ad1889f2b6600d7b98ab0cfe1"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-07T17:47:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ee5c8259cb0c30598dbdb5dc2df20f5a44ba138c5da30bfe6cabf955e681707d"}
{"level":"info","ts":"2026-07-07T17:47:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7fe0d80bd3060a4b116a3a1e875b9e1424fb9f3ad1889f2b6600d7b98ab0cfe1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T17:47:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"597c93ad52d13f8f9546c1f288952a470b1cbaa119def99c8ff4f25164de8787","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-07T17:47:20Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-07T17:47:20Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["597c93ad52d13f8f9546c1f288952a470b1cbaa119def99c8ff4f25164de8787"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-07T17:47:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/cde74f5de53e77d196a3aabf0abe3ce1507be42659b509a031e6951a70eae6ed"}
{"level":"info","ts":"2026-07-07T17:47:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"597c93ad52d13f8f9546c1f288952a470b1cbaa119def99c8ff4f25164de8787","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T17:47:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"cde74f5de53e77d196a3aabf0abe3ce1507be42659b509a031e6951a70eae6ed","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T17:47:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"442d566dec4dad9158d3574e413880479effad04ebc5220720f2ee87a5f9fab6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T17:47:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7fe0d80bd3060a4b116a3a1e875b9e1424fb9f3ad1889f2b6600d7b98ab0cfe1","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-07T17:47:20Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-07T17:47:20Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-07T17:47:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7fe0d80bd3060a4b116a3a1e875b9e1424fb9f3ad1889f2b6600d7b98ab0cfe1"}
{"level":"info","ts":"2026-07-07T17:47:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/597c93ad52d13f8f9546c1f288952a470b1cbaa119def99c8ff4f25164de8787"}
{"level":"info","ts":"2026-07-07T17:47:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7fe0d80bd3060a4b116a3a1e875b9e1424fb9f3ad1889f2b6600d7b98ab0cfe1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T17:47:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"597c93ad52d13f8f9546c1f288952a470b1cbaa119def99c8ff4f25164de8787","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T17:47:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4e2f8ee94fdcc577ae36273e7865ddc6628e7978cecea31e36afaabaa73f59e7","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T17:47:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7fe0d80bd3060a4b116a3a1e875b9e1424fb9f3ad1889f2b6600d7b98ab0cfe1","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-07T17:47:20Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-07T17:47:20Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["7fe0d80bd3060a4b116a3a1e875b9e1424fb9f3ad1889f2b6600d7b98ab0cfe1"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-07T17:47:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/442d566dec4dad9158d3574e413880479effad04ebc5220720f2ee87a5f9fab6"}
{"level":"info","ts":"2026-07-07T17:47:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7fe0d80bd3060a4b116a3a1e875b9e1424fb9f3ad1889f2b6600d7b98ab0cfe1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T17:47:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7fe0d80bd3060a4b116a3a1e875b9e1424fb9f3ad1889f2b6600d7b98ab0cfe1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T17:47:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7fe0d80bd3060a4b116a3a1e875b9e1424fb9f3ad1889f2b6600d7b98ab0cfe1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T17:47:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7fe0d80bd3060a4b116a3a1e875b9e1424fb9f3ad1889f2b6600d7b98ab0cfe1","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-07T17:47:20Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-07T17:47:20Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-07T17:47:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7fe0d80bd3060a4b116a3a1e875b9e1424fb9f3ad1889f2b6600d7b98ab0cfe1"}
{"level":"info","ts":"2026-07-07T17:47:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4e2f8ee94fdcc577ae36273e7865ddc6628e7978cecea31e36afaabaa73f59e7"}
{"level":"info","ts":"2026-07-07T17:47:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7fe0d80bd3060a4b116a3a1e875b9e1424fb9f3ad1889f2b6600d7b98ab0cfe1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T17:47:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e35dd82c5f507a8ec7a0c3addde269457b4ed249572e80e8920fa3b1ecacdcda","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T17:47:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7fe0d80bd3060a4b116a3a1e875b9e1424fb9f3ad1889f2b6600d7b98ab0cfe1","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-07T17:47:20Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-07T17:47:20Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["7fe0d80bd3060a4b116a3a1e875b9e1424fb9f3ad1889f2b6600d7b98ab0cfe1"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-07T17:47:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/597c93ad52d13f8f9546c1f288952a470b1cbaa119def99c8ff4f25164de8787"}
{"level":"info","ts":"2026-07-07T17:47:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7fe0d80bd3060a4b116a3a1e875b9e1424fb9f3ad1889f2b6600d7b98ab0cfe1"}
{"level":"info","ts":"2026-07-07T17:47:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7fe0d80bd3060a4b116a3a1e875b9e1424fb9f3ad1889f2b6600d7b98ab0cfe1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T17:47:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7fe0d80bd3060a4b116a3a1e875b9e1424fb9f3ad1889f2b6600d7b98ab0cfe1","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-07T17:47:20Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-07T17:47:20Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["7fe0d80bd3060a4b116a3a1e875b9e1424fb9f3ad1889f2b6600d7b98ab0cfe1"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"error","ts":"2026-07-07T17:47:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"7fe0d80bd3060a4b116a3a1e875b9e1424fb9f3ad1889f2b6600d7b98ab0cfe1","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"7fe0d80bd3060a4b116a3a1e875b9e1424fb9f3ad1889f2b6600d7b98ab0cfe1\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-07T17:47:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"0a33e88fb8a6bad06d34e77f290e999d360e20ee1485ebfa18dbce2ee297666f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T17:47:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7fe0d80bd3060a4b116a3a1e875b9e1424fb9f3ad1889f2b6600d7b98ab0cfe1","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-07T17:47:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e35dd82c5f507a8ec7a0c3addde269457b4ed249572e80e8920fa3b1ecacdcda"}
{"level":"debug","ts":"2026-07-07T17:47:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7fe0d80bd3060a4b116a3a1e875b9e1424fb9f3ad1889f2b6600d7b98ab0cfe1","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-07T17:47:20Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-07T17:47:20Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-07T17:47:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7fe0d80bd3060a4b116a3a1e875b9e1424fb9f3ad1889f2b6600d7b98ab0cfe1"}
{"level":"info","ts":"2026-07-07T17:47:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/0a33e88fb8a6bad06d34e77f290e999d360e20ee1485ebfa18dbce2ee297666f"}
{"level":"info","ts":"2026-07-07T17:47:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7fe0d80bd3060a4b116a3a1e875b9e1424fb9f3ad1889f2b6600d7b98ab0cfe1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T17:47:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"73b5c4a83f30d3e11ab6ee2d6681e8ac53330e37c3bc51d5d25c29d25aa064c6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-07T17:47:20Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-07T17:47:20Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-07T17:47:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/73b5c4a83f30d3e11ab6ee2d6681e8ac53330e37c3bc51d5d25c29d25aa064c6"}
{"level":"info","ts":"2026-07-07T17:47:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f2075297ed7421c5919479862eaa011c0cb7cd93e5f7a6db054e83dd768a2ad0"}
{"level":"info","ts":"2026-07-07T17:47:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"73b5c4a83f30d3e11ab6ee2d6681e8ac53330e37c3bc51d5d25c29d25aa064c6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T17:47:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f2075297ed7421c5919479862eaa011c0cb7cd93e5f7a6db054e83dd768a2ad0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T17:47:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7fe0d80bd3060a4b116a3a1e875b9e1424fb9f3ad1889f2b6600d7b98ab0cfe1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T17:47:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"221a9bd70341311fc5cc0dc86ae2f43461a4902d7bbbb6e9537fca0495b1bfc9","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T17:47:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"73b5c4a83f30d3e11ab6ee2d6681e8ac53330e37c3bc51d5d25c29d25aa064c6","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-07T17:47:20Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-07T17:47:20Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["73b5c4a83f30d3e11ab6ee2d6681e8ac53330e37c3bc51d5d25c29d25aa064c6"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-07T17:47:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7fe0d80bd3060a4b116a3a1e875b9e1424fb9f3ad1889f2b6600d7b98ab0cfe1"}
{"level":"info","ts":"2026-07-07T17:47:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"73b5c4a83f30d3e11ab6ee2d6681e8ac53330e37c3bc51d5d25c29d25aa064c6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T17:47:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7fe0d80bd3060a4b116a3a1e875b9e1424fb9f3ad1889f2b6600d7b98ab0cfe1","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-07T17:47:20Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-07T17:47:20Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["7fe0d80bd3060a4b116a3a1e875b9e1424fb9f3ad1889f2b6600d7b98ab0cfe1"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-07T17:47:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/221a9bd70341311fc5cc0dc86ae2f43461a4902d7bbbb6e9537fca0495b1bfc9"}
{"level":"info","ts":"2026-07-07T17:47:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/73b5c4a83f30d3e11ab6ee2d6681e8ac53330e37c3bc51d5d25c29d25aa064c6"}
{"level":"info","ts":"2026-07-07T17:47:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7fe0d80bd3060a4b116a3a1e875b9e1424fb9f3ad1889f2b6600d7b98ab0cfe1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T17:47:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"73b5c4a83f30d3e11ab6ee2d6681e8ac53330e37c3bc51d5d25c29d25aa064c6","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T17:47:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"00760d4002d15857a8c7f9f5289c07006c221ca2d0077384071333e4894d149c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-07T17:47:20Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-07T17:47:20Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-07T17:47:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/00760d4002d15857a8c7f9f5289c07006c221ca2d0077384071333e4894d149c"}
{"level":"info","ts":"2026-07-07T17:47:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"00760d4002d15857a8c7f9f5289c07006c221ca2d0077384071333e4894d149c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T17:47:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7fe0d80bd3060a4b116a3a1e875b9e1424fb9f3ad1889f2b6600d7b98ab0cfe1","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-07T17:47:20Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-07T17:47:20Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-07T17:47:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7fe0d80bd3060a4b116a3a1e875b9e1424fb9f3ad1889f2b6600d7b98ab0cfe1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T17:47:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1de2c521ad4d2f13175c4a163f70eaf72310b2388c3672e7c42a9b7df959a3de","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T17:47:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"00760d4002d15857a8c7f9f5289c07006c221ca2d0077384071333e4894d149c","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-07T17:47:20Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-07T17:47:20Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["00760d4002d15857a8c7f9f5289c07006c221ca2d0077384071333e4894d149c"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-07T17:47:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7fe0d80bd3060a4b116a3a1e875b9e1424fb9f3ad1889f2b6600d7b98ab0cfe1"}
{"level":"info","ts":"2026-07-07T17:47:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"00760d4002d15857a8c7f9f5289c07006c221ca2d0077384071333e4894d149c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T17:47:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ce6a24861f2e3d59dfe44943df9ca381d708e599247246eba240175ee5c6ffb0","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T17:47:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"7fe0d80bd3060a4b116a3a1e875b9e1424fb9f3ad1889f2b6600d7b98ab0cfe1","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-07T17:47:20Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-07T17:47:20Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["7fe0d80bd3060a4b116a3a1e875b9e1424fb9f3ad1889f2b6600d7b98ab0cfe1"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-07T17:47:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"7fe0d80bd3060a4b116a3a1e875b9e1424fb9f3ad1889f2b6600d7b98ab0cfe1","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T17:47:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"86d92ea941495ba23e0743303ffd07e32188c7eec7ce21d8939a5447d2deed4a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T17:47:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"00760d4002d15857a8c7f9f5289c07006c221ca2d0077384071333e4894d149c","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T17:47:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2616a94aed0781c95a8b1dadc81e4317fa9558b2ccf4637f4b7332de68035f14","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-07T17:47:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"7fe0d80bd3060a4b116a3a1e875b9e1424fb9f3ad1889f2b6600d7b98ab0cfe1","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-07T17:47:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1de2c521ad4d2f13175c4a163f70eaf72310b2388c3672e7c42a9b7df959a3de"}
{"level":"info","ts":"2026-07-07T17:47:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/00760d4002d15857a8c7f9f5289c07006c221ca2d0077384071333e4894d149c"}
{"level":"debug","ts":"2026-07-07T17:47:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b9ebfcb56afbb067c20781282a3a25e427d64ac1f133062212f269f94775542e","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-07T17:47:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ce6a24861f2e3d59dfe44943df9ca381d708e599247246eba240175ee5c6ffb0"}
{"level":"debug","ts":"2026-07-07T17:47:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"ebe092ef797333c678bf90cc592fa1b8100c05b1a652e3720595563b89dcc442","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-07T17:47:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/7fe0d80bd3060a4b116a3a1e875b9e1424fb9f3ad1889f2b6600d7b98ab0cfe1"}
{"level":"info","ts":"2026-07-07T17:47:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/86d92ea941495ba23e0743303ffd07e32188c7eec7ce21d8939a5447d2deed4a"}
{"level":"info","ts":"2026-07-07T17:47:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2616a94aed0781c95a8b1dadc81e4317fa9558b2ccf4637f4b7332de68035f14"}
{"level":"info","ts":"2026-07-07T17:47:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b9ebfcb56afbb067c20781282a3a25e427d64ac1f133062212f269f94775542e"}
{"level":"info","ts":"2026-07-07T17:47:20Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/ebe092ef797333c678bf90cc592fa1b8100c05b1a652e3720595563b89dcc442"}
{"level":"info","ts":"2026-07-07T17:47:22Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"dae32786-bd54-4703-b3f2-fa6b0c984ea0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.10:32840","PortSpecifier":{"PortValue":32840}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.59:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"dae32786-bd54-4703-b3f2-fa6b0c984ea0","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-19c9b1.apps.1d97bdc8-b55d-4428-9c0a-c26313fcaa60.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T17:47:22Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"dae32786-bd54-4703-b3f2-fa6b0c984ea0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.10:32840","PortSpecifier":{"PortValue":32840}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.59:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783446442,"nanos":645739636},"http":{"id":"dae32786-bd54-4703-b3f2-fa6b0c984ea0","method":"POST","headers":{":authority":"e2e-shared-a-19c9b1.apps.1d97bdc8-b55d-4428-9c0a-c26313fcaa60.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T17:47:22Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"dae32786-bd54-4703-b3f2-fa6b0c984ea0","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T17:47:22Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"dae32786-bd54-4703-b3f2-fa6b0c984ea0","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fe2d1374-3506-4595-ba2a-c54968aa7ca0","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=837fe462-1f38-4836-a7b2-ac69beffdf31"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/c26313fcaa60"]}}
{"level":"debug","ts":"2026-07-07T17:47:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"dae32786-bd54-4703-b3f2-fa6b0c984ea0","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/c26313fcaa60"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=837fe462-1f38-4836-a7b2-ac69beffdf31"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fe2d1374-3506-4595-ba2a-c54968aa7ca0","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"ce6a24861f2e3d59dfe44943df9ca381d708e599247246eba240175ee5c6ffb0"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.59:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-19c9b1.apps.1d97bdc8-b55d-4428-9c0a-c26313fcaa60.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T17:47:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"dae32786-bd54-4703-b3f2-fa6b0c984ea0","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T17:47:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"dae32786-bd54-4703-b3f2-fa6b0c984ea0","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T17:47:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"dae32786-bd54-4703-b3f2-fa6b0c984ea0","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-19c9b1/rate-test-model-19c9b1\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T17:47:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"dae32786-bd54-4703-b3f2-fa6b0c984ea0","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T17:47:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"dae32786-bd54-4703-b3f2-fa6b0c984ea0","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T17:47:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"dae32786-bd54-4703-b3f2-fa6b0c984ea0","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T17:47:22Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"dae32786-bd54-4703-b3f2-fa6b0c984ea0","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T17:47:22Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"dae32786-bd54-4703-b3f2-fa6b0c984ea0","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T17:47:22Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0bf41b0c-0f97-48e9-a45f-644f499c8077","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.10:40804","PortSpecifier":{"PortValue":40804}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.38:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"0bf41b0c-0f97-48e9-a45f-644f499c8077","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-ce87c9.apps.1d97bdc8-b55d-4428-9c0a-c26313fcaa60.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T17:47:22Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0bf41b0c-0f97-48e9-a45f-644f499c8077","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.10:40804","PortSpecifier":{"PortValue":40804}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.38:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783446442,"nanos":689006506},"http":{"id":"0bf41b0c-0f97-48e9-a45f-644f499c8077","method":"POST","headers":{":authority":"e2e-shared-b-ce87c9.apps.1d97bdc8-b55d-4428-9c0a-c26313fcaa60.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T17:47:22Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"0bf41b0c-0f97-48e9-a45f-644f499c8077","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T17:47:22Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"0bf41b0c-0f97-48e9-a45f-644f499c8077","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fe2d1374-3506-4595-ba2a-c54968aa7ca0","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=837fe462-1f38-4836-a7b2-ac69beffdf31"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/c26313fcaa60"]}}
{"level":"debug","ts":"2026-07-07T17:47:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"0bf41b0c-0f97-48e9-a45f-644f499c8077","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/c26313fcaa60"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=837fe462-1f38-4836-a7b2-ac69beffdf31"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fe2d1374-3506-4595-ba2a-c54968aa7ca0","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"e0f8e20e049197b76ebeac4abe24f913efd1e862a1a1ff6ba439b4ecc04dfe06"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.38:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-ce87c9.apps.1d97bdc8-b55d-4428-9c0a-c26313fcaa60.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T17:47:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0bf41b0c-0f97-48e9-a45f-644f499c8077","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T17:47:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0bf41b0c-0f97-48e9-a45f-644f499c8077","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T17:47:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0bf41b0c-0f97-48e9-a45f-644f499c8077","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-ce87c9/rate-test-model-ce87c9\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T17:47:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"0bf41b0c-0f97-48e9-a45f-644f499c8077","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T17:47:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0bf41b0c-0f97-48e9-a45f-644f499c8077","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T17:47:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0bf41b0c-0f97-48e9-a45f-644f499c8077","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T17:47:22Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0bf41b0c-0f97-48e9-a45f-644f499c8077","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T17:47:22Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0bf41b0c-0f97-48e9-a45f-644f499c8077","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T17:47:22Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"cb24daa8-037c-4889-99a8-da689cd2b752","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.10:32844","PortSpecifier":{"PortValue":32844}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.59:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"cb24daa8-037c-4889-99a8-da689cd2b752","method":"POST","path":"/ai-tenant-e2e-shared-a-19c9b1/rate-test-model-19c9b1/v1/completions","host":"e2e-shared-a-19c9b1.apps.1d97bdc8-b55d-4428-9c0a-c26313fcaa60.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T17:47:22Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"cb24daa8-037c-4889-99a8-da689cd2b752","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.10:32844","PortSpecifier":{"PortValue":32844}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.59:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783446442,"nanos":727594268},"http":{"id":"cb24daa8-037c-4889-99a8-da689cd2b752","method":"POST","headers":{":authority":"e2e-shared-a-19c9b1.apps.1d97bdc8-b55d-4428-9c0a-c26313fcaa60.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-19c9b1/rate-test-model-19c9b1/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T17:47:22Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"cb24daa8-037c-4889-99a8-da689cd2b752","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-kRBM3iiqvRJoDf0x_d4QvTh4fs7wGi0Y5MNkAs49LxWNIM1quRtXwCvmuI2d"}
{"level":"debug","ts":"2026-07-07T17:47:22Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"cb24daa8-037c-4889-99a8-da689cd2b752","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-19c9b1.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-kRBM3iiqvRJoDf0x_d4QvTh4fs7wGi0Y5MNkAs49LxWNIM1quRtXwCvmuI2d\"}"}
{"level":"debug","ts":"2026-07-07T17:47:22Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"cb24daa8-037c-4889-99a8-da689cd2b752","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-19c9b1.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"7d9433bf-c423-440f-a08a-e703a6d0f054","keyName":"e2e-rate-a-b1fde2","subscription":"e2e-rate-iso-a-b1fde2","tenant":"e2e-shared-a-19c9b1","userId":"7d9433bf-c423-440f-a08a-e703a6d0f054","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-07T17:47:22Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"cb24daa8-037c-4889-99a8-da689cd2b752","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-19c9b1.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-19c9b1/rate-test-model-19c9b1\",\"requestedSubscription\":\"e2e-rate-iso-a-b1fde2\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-07T17:47:22Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"cb24daa8-037c-4889-99a8-da689cd2b752","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-19c9b1.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-19c9b1","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-b1fde2","namespace":"ai-tenant-e2e-shared-a-19c9b1","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-07T17:47:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"cb24daa8-037c-4889-99a8-da689cd2b752","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T17:47:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cb24daa8-037c-4889-99a8-da689cd2b752","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T17:47:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cb24daa8-037c-4889-99a8-da689cd2b752","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T17:47:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cb24daa8-037c-4889-99a8-da689cd2b752","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T17:47:22Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cb24daa8-037c-4889-99a8-da689cd2b752","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-19c9b1/rate-test-model-19c9b1\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T17:47:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cb24daa8-037c-4889-99a8-da689cd2b752","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T17:47:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cb24daa8-037c-4889-99a8-da689cd2b752","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-b1fde2"}
{"level":"debug","ts":"2026-07-07T17:47:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cb24daa8-037c-4889-99a8-da689cd2b752","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-07T17:47:22Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cb24daa8-037c-4889-99a8-da689cd2b752","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"7d9433bf-c423-440f-a08a-e703a6d0f054","keyName":"e2e-rate-a-b1fde2","selected_subscription":"e2e-rate-iso-a-b1fde2","selected_subscription_key":"ai-tenant-e2e-shared-a-19c9b1/e2e-rate-iso-a-b1fde2@ai-tenant-e2e-shared-a-19c9b1/rate-test-model-19c9b1","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-19c9b1","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-b1fde2","namespace":"ai-tenant-e2e-shared-a-19c9b1","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-07T17:47:22Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"cb24daa8-037c-4889-99a8-da689cd2b752","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T17:47:22Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"cb24daa8-037c-4889-99a8-da689cd2b752","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T17:47:23Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3cc32728-2397-433e-98b4-a0addd879e5e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.10:39782","PortSpecifier":{"PortValue":39782}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.59:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"3cc32728-2397-433e-98b4-a0addd879e5e","method":"POST","path":"/ai-tenant-e2e-shared-a-19c9b1/rate-test-model-19c9b1/v1/completions","host":"e2e-shared-a-19c9b1.apps.1d97bdc8-b55d-4428-9c0a-c26313fcaa60.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T17:47:23Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3cc32728-2397-433e-98b4-a0addd879e5e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.10:39782","PortSpecifier":{"PortValue":39782}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.59:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783446443,"nanos":788657317},"http":{"id":"3cc32728-2397-433e-98b4-a0addd879e5e","method":"POST","headers":{":authority":"e2e-shared-a-19c9b1.apps.1d97bdc8-b55d-4428-9c0a-c26313fcaa60.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-19c9b1/rate-test-model-19c9b1/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T17:47:23Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"3cc32728-2397-433e-98b4-a0addd879e5e","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-kRBM3iiqvRJoDf0x_d4QvTh4fs7wGi0Y5MNkAs49LxWNIM1quRtXwCvmuI2d"}
{"level":"debug","ts":"2026-07-07T17:47:23Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"3cc32728-2397-433e-98b4-a0addd879e5e","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-19c9b1.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-kRBM3iiqvRJoDf0x_d4QvTh4fs7wGi0Y5MNkAs49LxWNIM1quRtXwCvmuI2d\"}"}
{"level":"debug","ts":"2026-07-07T17:47:23Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"3cc32728-2397-433e-98b4-a0addd879e5e","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-19c9b1.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"7d9433bf-c423-440f-a08a-e703a6d0f054","keyName":"e2e-rate-a-b1fde2","subscription":"e2e-rate-iso-a-b1fde2","tenant":"e2e-shared-a-19c9b1","userId":"7d9433bf-c423-440f-a08a-e703a6d0f054","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-07T17:47:23Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"3cc32728-2397-433e-98b4-a0addd879e5e","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-19c9b1.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-19c9b1/rate-test-model-19c9b1\",\"requestedSubscription\":\"e2e-rate-iso-a-b1fde2\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-07T17:47:23Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"3cc32728-2397-433e-98b4-a0addd879e5e","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-19c9b1.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-19c9b1","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-b1fde2","namespace":"ai-tenant-e2e-shared-a-19c9b1","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-07T17:47:23Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"3cc32728-2397-433e-98b4-a0addd879e5e","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T17:47:23Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3cc32728-2397-433e-98b4-a0addd879e5e","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T17:47:23Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3cc32728-2397-433e-98b4-a0addd879e5e","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T17:47:23Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3cc32728-2397-433e-98b4-a0addd879e5e","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-19c9b1/rate-test-model-19c9b1\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T17:47:23Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3cc32728-2397-433e-98b4-a0addd879e5e","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T17:47:23Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3cc32728-2397-433e-98b4-a0addd879e5e","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T17:47:23Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3cc32728-2397-433e-98b4-a0addd879e5e","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-07T17:47:23Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3cc32728-2397-433e-98b4-a0addd879e5e","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-b1fde2"}
{"level":"debug","ts":"2026-07-07T17:47:23Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3cc32728-2397-433e-98b4-a0addd879e5e","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"7d9433bf-c423-440f-a08a-e703a6d0f054","keyName":"e2e-rate-a-b1fde2","selected_subscription":"e2e-rate-iso-a-b1fde2","selected_subscription_key":"ai-tenant-e2e-shared-a-19c9b1/e2e-rate-iso-a-b1fde2@ai-tenant-e2e-shared-a-19c9b1/rate-test-model-19c9b1","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-19c9b1","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-b1fde2","namespace":"ai-tenant-e2e-shared-a-19c9b1","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-07T17:47:23Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3cc32728-2397-433e-98b4-a0addd879e5e","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T17:47:23Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3cc32728-2397-433e-98b4-a0addd879e5e","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T17:47:24Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"61c7ef84-7066-40fb-a43a-36ef9fe49ddf","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.10:39796","PortSpecifier":{"PortValue":39796}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.59:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"61c7ef84-7066-40fb-a43a-36ef9fe49ddf","method":"POST","path":"/ai-tenant-e2e-shared-a-19c9b1/rate-test-model-19c9b1/v1/completions","host":"e2e-shared-a-19c9b1.apps.1d97bdc8-b55d-4428-9c0a-c26313fcaa60.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T17:47:24Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"61c7ef84-7066-40fb-a43a-36ef9fe49ddf","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.10:39796","PortSpecifier":{"PortValue":39796}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.59:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783446444,"nanos":832483802},"http":{"id":"61c7ef84-7066-40fb-a43a-36ef9fe49ddf","method":"POST","headers":{":authority":"e2e-shared-a-19c9b1.apps.1d97bdc8-b55d-4428-9c0a-c26313fcaa60.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-19c9b1/rate-test-model-19c9b1/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T17:47:24Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"61c7ef84-7066-40fb-a43a-36ef9fe49ddf","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-kRBM3iiqvRJoDf0x_d4QvTh4fs7wGi0Y5MNkAs49LxWNIM1quRtXwCvmuI2d"}
{"level":"debug","ts":"2026-07-07T17:47:24Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"61c7ef84-7066-40fb-a43a-36ef9fe49ddf","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-19c9b1.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-kRBM3iiqvRJoDf0x_d4QvTh4fs7wGi0Y5MNkAs49LxWNIM1quRtXwCvmuI2d\"}"}
{"level":"debug","ts":"2026-07-07T17:47:24Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"61c7ef84-7066-40fb-a43a-36ef9fe49ddf","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-19c9b1.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"7d9433bf-c423-440f-a08a-e703a6d0f054","keyName":"e2e-rate-a-b1fde2","subscription":"e2e-rate-iso-a-b1fde2","tenant":"e2e-shared-a-19c9b1","userId":"7d9433bf-c423-440f-a08a-e703a6d0f054","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-07T17:47:24Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"61c7ef84-7066-40fb-a43a-36ef9fe49ddf","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-19c9b1.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-19c9b1/rate-test-model-19c9b1\",\"requestedSubscription\":\"e2e-rate-iso-a-b1fde2\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-07T17:47:24Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"61c7ef84-7066-40fb-a43a-36ef9fe49ddf","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-19c9b1.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-19c9b1","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-b1fde2","namespace":"ai-tenant-e2e-shared-a-19c9b1","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-07T17:47:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"61c7ef84-7066-40fb-a43a-36ef9fe49ddf","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T17:47:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"61c7ef84-7066-40fb-a43a-36ef9fe49ddf","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T17:47:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"61c7ef84-7066-40fb-a43a-36ef9fe49ddf","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T17:47:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"61c7ef84-7066-40fb-a43a-36ef9fe49ddf","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-19c9b1/rate-test-model-19c9b1\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T17:47:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"61c7ef84-7066-40fb-a43a-36ef9fe49ddf","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T17:47:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"61c7ef84-7066-40fb-a43a-36ef9fe49ddf","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T17:47:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"61c7ef84-7066-40fb-a43a-36ef9fe49ddf","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-b1fde2"}
{"level":"debug","ts":"2026-07-07T17:47:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"61c7ef84-7066-40fb-a43a-36ef9fe49ddf","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-07T17:47:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"61c7ef84-7066-40fb-a43a-36ef9fe49ddf","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"7d9433bf-c423-440f-a08a-e703a6d0f054","keyName":"e2e-rate-a-b1fde2","selected_subscription":"e2e-rate-iso-a-b1fde2","selected_subscription_key":"ai-tenant-e2e-shared-a-19c9b1/e2e-rate-iso-a-b1fde2@ai-tenant-e2e-shared-a-19c9b1/rate-test-model-19c9b1","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-19c9b1","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-b1fde2","namespace":"ai-tenant-e2e-shared-a-19c9b1","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-07T17:47:24Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"61c7ef84-7066-40fb-a43a-36ef9fe49ddf","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T17:47:24Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"61c7ef84-7066-40fb-a43a-36ef9fe49ddf","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T17:47:33Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f9ec7561-7812-424a-89e4-cff41de741fe","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.10:45984","PortSpecifier":{"PortValue":45984}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.59:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"f9ec7561-7812-424a-89e4-cff41de741fe","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-19c9b1.apps.1d97bdc8-b55d-4428-9c0a-c26313fcaa60.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T17:47:33Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f9ec7561-7812-424a-89e4-cff41de741fe","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.10:45984","PortSpecifier":{"PortValue":45984}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.59:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783446453,"nanos":923831045},"http":{"id":"f9ec7561-7812-424a-89e4-cff41de741fe","method":"POST","headers":{":authority":"e2e-shared-a-19c9b1.apps.1d97bdc8-b55d-4428-9c0a-c26313fcaa60.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T17:47:33Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"f9ec7561-7812-424a-89e4-cff41de741fe","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T17:47:33Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"f9ec7561-7812-424a-89e4-cff41de741fe","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fe2d1374-3506-4595-ba2a-c54968aa7ca0","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=837fe462-1f38-4836-a7b2-ac69beffdf31"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/c26313fcaa60"]}}
{"level":"debug","ts":"2026-07-07T17:47:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"f9ec7561-7812-424a-89e4-cff41de741fe","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/c26313fcaa60"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=837fe462-1f38-4836-a7b2-ac69beffdf31"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fe2d1374-3506-4595-ba2a-c54968aa7ca0","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"ce6a24861f2e3d59dfe44943df9ca381d708e599247246eba240175ee5c6ffb0"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.59:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-19c9b1.apps.1d97bdc8-b55d-4428-9c0a-c26313fcaa60.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T17:47:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f9ec7561-7812-424a-89e4-cff41de741fe","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T17:47:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f9ec7561-7812-424a-89e4-cff41de741fe","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T17:47:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f9ec7561-7812-424a-89e4-cff41de741fe","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-19c9b1/rate-test-model-19c9b1\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T17:47:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"f9ec7561-7812-424a-89e4-cff41de741fe","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T17:47:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f9ec7561-7812-424a-89e4-cff41de741fe","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T17:47:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f9ec7561-7812-424a-89e4-cff41de741fe","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T17:47:33Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f9ec7561-7812-424a-89e4-cff41de741fe","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T17:47:33Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f9ec7561-7812-424a-89e4-cff41de741fe","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T17:47:33Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2027e0ee-8f2a-4570-9ed5-362aa5d1c8fd","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.10:48146","PortSpecifier":{"PortValue":48146}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.38:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"2027e0ee-8f2a-4570-9ed5-362aa5d1c8fd","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-ce87c9.apps.1d97bdc8-b55d-4428-9c0a-c26313fcaa60.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T17:47:33Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2027e0ee-8f2a-4570-9ed5-362aa5d1c8fd","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.10:48146","PortSpecifier":{"PortValue":48146}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.38:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783446453,"nanos":991860784},"http":{"id":"2027e0ee-8f2a-4570-9ed5-362aa5d1c8fd","method":"POST","headers":{":authority":"e2e-shared-b-ce87c9.apps.1d97bdc8-b55d-4428-9c0a-c26313fcaa60.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T17:47:33Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"2027e0ee-8f2a-4570-9ed5-362aa5d1c8fd","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-07T17:47:33Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"2027e0ee-8f2a-4570-9ed5-362aa5d1c8fd","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"fe2d1374-3506-4595-ba2a-c54968aa7ca0","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=837fe462-1f38-4836-a7b2-ac69beffdf31"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/c26313fcaa60"]}}
{"level":"debug","ts":"2026-07-07T17:47:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"2027e0ee-8f2a-4570-9ed5-362aa5d1c8fd","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/c26313fcaa60"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=837fe462-1f38-4836-a7b2-ac69beffdf31"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"fe2d1374-3506-4595-ba2a-c54968aa7ca0","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"e0f8e20e049197b76ebeac4abe24f913efd1e862a1a1ff6ba439b4ecc04dfe06"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.38:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-ce87c9.apps.1d97bdc8-b55d-4428-9c0a-c26313fcaa60.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T17:47:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2027e0ee-8f2a-4570-9ed5-362aa5d1c8fd","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T17:47:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2027e0ee-8f2a-4570-9ed5-362aa5d1c8fd","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T17:47:33Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2027e0ee-8f2a-4570-9ed5-362aa5d1c8fd","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-ce87c9/rate-test-model-ce87c9\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T17:47:33Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"2027e0ee-8f2a-4570-9ed5-362aa5d1c8fd","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"groups","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-07T17:47:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2027e0ee-8f2a-4570-9ed5-362aa5d1c8fd","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T17:47:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2027e0ee-8f2a-4570-9ed5-362aa5d1c8fd","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-07T17:47:34Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2027e0ee-8f2a-4570-9ed5-362aa5d1c8fd","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T17:47:34Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2027e0ee-8f2a-4570-9ed5-362aa5d1c8fd","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T17:47:34Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"99b90427-f198-48a9-87af-dc7b62eff981","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.10:45988","PortSpecifier":{"PortValue":45988}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.59:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"99b90427-f198-48a9-87af-dc7b62eff981","method":"POST","path":"/ai-tenant-e2e-shared-a-19c9b1/rate-test-model-19c9b1/v1/completions","host":"e2e-shared-a-19c9b1.apps.1d97bdc8-b55d-4428-9c0a-c26313fcaa60.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T17:47:34Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"99b90427-f198-48a9-87af-dc7b62eff981","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.10:45988","PortSpecifier":{"PortValue":45988}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.59:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783446454,"nanos":33061671},"http":{"id":"99b90427-f198-48a9-87af-dc7b62eff981","method":"POST","headers":{":authority":"e2e-shared-a-19c9b1.apps.1d97bdc8-b55d-4428-9c0a-c26313fcaa60.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-19c9b1/rate-test-model-19c9b1/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T17:47:34Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"99b90427-f198-48a9-87af-dc7b62eff981","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-3UF9Ufkdr0pyv1KI_qxCIChFIde5yNvkkrUZcP4ux9IV52r6hEyIEZ14PCCP"}
{"level":"debug","ts":"2026-07-07T17:47:34Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"99b90427-f198-48a9-87af-dc7b62eff981","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-19c9b1.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-3UF9Ufkdr0pyv1KI_qxCIChFIde5yNvkkrUZcP4ux9IV52r6hEyIEZ14PCCP\"}"}
{"level":"debug","ts":"2026-07-07T17:47:34Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"99b90427-f198-48a9-87af-dc7b62eff981","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-19c9b1.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"b11d09b7-0e00-4b1b-af03-4603a413c962","keyName":"e2e-rate-a-0eb5de","subscription":"e2e-rate-iso-a-0eb5de","tenant":"e2e-shared-a-19c9b1","userId":"b11d09b7-0e00-4b1b-af03-4603a413c962","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-07T17:47:34Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"99b90427-f198-48a9-87af-dc7b62eff981","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-19c9b1.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-19c9b1/rate-test-model-19c9b1\",\"requestedSubscription\":\"e2e-rate-iso-a-0eb5de\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-07T17:47:34Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"99b90427-f198-48a9-87af-dc7b62eff981","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-19c9b1.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-19c9b1","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-0eb5de","namespace":"ai-tenant-e2e-shared-a-19c9b1","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-07T17:47:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"99b90427-f198-48a9-87af-dc7b62eff981","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T17:47:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"99b90427-f198-48a9-87af-dc7b62eff981","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T17:47:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"99b90427-f198-48a9-87af-dc7b62eff981","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T17:47:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"99b90427-f198-48a9-87af-dc7b62eff981","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-19c9b1/rate-test-model-19c9b1\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T17:47:34Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"99b90427-f198-48a9-87af-dc7b62eff981","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T17:47:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"99b90427-f198-48a9-87af-dc7b62eff981","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T17:47:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"99b90427-f198-48a9-87af-dc7b62eff981","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-07T17:47:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"99b90427-f198-48a9-87af-dc7b62eff981","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-0eb5de"}
{"level":"debug","ts":"2026-07-07T17:47:34Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"99b90427-f198-48a9-87af-dc7b62eff981","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"b11d09b7-0e00-4b1b-af03-4603a413c962","keyName":"e2e-rate-a-0eb5de","selected_subscription":"e2e-rate-iso-a-0eb5de","selected_subscription_key":"ai-tenant-e2e-shared-a-19c9b1/e2e-rate-iso-a-0eb5de@ai-tenant-e2e-shared-a-19c9b1/rate-test-model-19c9b1","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-19c9b1","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-0eb5de","namespace":"ai-tenant-e2e-shared-a-19c9b1","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-07T17:47:34Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"99b90427-f198-48a9-87af-dc7b62eff981","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T17:47:34Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"99b90427-f198-48a9-87af-dc7b62eff981","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T17:47:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"433c97ed-4531-4e7f-947a-b5bbbd3bc7e7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.10:46004","PortSpecifier":{"PortValue":46004}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.59:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"433c97ed-4531-4e7f-947a-b5bbbd3bc7e7","method":"POST","path":"/ai-tenant-e2e-shared-a-19c9b1/rate-test-model-19c9b1/v1/completions","host":"e2e-shared-a-19c9b1.apps.1d97bdc8-b55d-4428-9c0a-c26313fcaa60.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T17:47:35Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"433c97ed-4531-4e7f-947a-b5bbbd3bc7e7","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.10:46004","PortSpecifier":{"PortValue":46004}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.59:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783446455,"nanos":80012533},"http":{"id":"433c97ed-4531-4e7f-947a-b5bbbd3bc7e7","method":"POST","headers":{":authority":"e2e-shared-a-19c9b1.apps.1d97bdc8-b55d-4428-9c0a-c26313fcaa60.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-19c9b1/rate-test-model-19c9b1/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T17:47:35Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"433c97ed-4531-4e7f-947a-b5bbbd3bc7e7","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-3UF9Ufkdr0pyv1KI_qxCIChFIde5yNvkkrUZcP4ux9IV52r6hEyIEZ14PCCP"}
{"level":"debug","ts":"2026-07-07T17:47:35Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"433c97ed-4531-4e7f-947a-b5bbbd3bc7e7","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-19c9b1.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-3UF9Ufkdr0pyv1KI_qxCIChFIde5yNvkkrUZcP4ux9IV52r6hEyIEZ14PCCP\"}"}
{"level":"debug","ts":"2026-07-07T17:47:35Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"433c97ed-4531-4e7f-947a-b5bbbd3bc7e7","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-19c9b1.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"b11d09b7-0e00-4b1b-af03-4603a413c962","keyName":"e2e-rate-a-0eb5de","subscription":"e2e-rate-iso-a-0eb5de","tenant":"e2e-shared-a-19c9b1","userId":"b11d09b7-0e00-4b1b-af03-4603a413c962","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-07T17:47:35Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"433c97ed-4531-4e7f-947a-b5bbbd3bc7e7","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-19c9b1.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-19c9b1/rate-test-model-19c9b1\",\"requestedSubscription\":\"e2e-rate-iso-a-0eb5de\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-07T17:47:35Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"433c97ed-4531-4e7f-947a-b5bbbd3bc7e7","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-19c9b1.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-19c9b1","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-0eb5de","namespace":"ai-tenant-e2e-shared-a-19c9b1","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-07T17:47:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"433c97ed-4531-4e7f-947a-b5bbbd3bc7e7","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T17:47:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"433c97ed-4531-4e7f-947a-b5bbbd3bc7e7","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T17:47:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"433c97ed-4531-4e7f-947a-b5bbbd3bc7e7","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T17:47:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"433c97ed-4531-4e7f-947a-b5bbbd3bc7e7","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-19c9b1/rate-test-model-19c9b1\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T17:47:35Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"433c97ed-4531-4e7f-947a-b5bbbd3bc7e7","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T17:47:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"433c97ed-4531-4e7f-947a-b5bbbd3bc7e7","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T17:47:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"433c97ed-4531-4e7f-947a-b5bbbd3bc7e7","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-0eb5de"}
{"level":"debug","ts":"2026-07-07T17:47:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"433c97ed-4531-4e7f-947a-b5bbbd3bc7e7","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-07T17:47:35Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"433c97ed-4531-4e7f-947a-b5bbbd3bc7e7","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"b11d09b7-0e00-4b1b-af03-4603a413c962","keyName":"e2e-rate-a-0eb5de","selected_subscription":"e2e-rate-iso-a-0eb5de","selected_subscription_key":"ai-tenant-e2e-shared-a-19c9b1/e2e-rate-iso-a-0eb5de@ai-tenant-e2e-shared-a-19c9b1/rate-test-model-19c9b1","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-19c9b1","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-0eb5de","namespace":"ai-tenant-e2e-shared-a-19c9b1","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-07T17:47:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"433c97ed-4531-4e7f-947a-b5bbbd3bc7e7","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T17:47:35Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"433c97ed-4531-4e7f-947a-b5bbbd3bc7e7","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T17:47:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2a05300b-a8a6-4956-8f1b-e0e7c1486248","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.10:46012","PortSpecifier":{"PortValue":46012}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.59:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"2a05300b-a8a6-4956-8f1b-e0e7c1486248","method":"POST","path":"/ai-tenant-e2e-shared-a-19c9b1/rate-test-model-19c9b1/v1/completions","host":"e2e-shared-a-19c9b1.apps.1d97bdc8-b55d-4428-9c0a-c26313fcaa60.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T17:47:36Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2a05300b-a8a6-4956-8f1b-e0e7c1486248","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.10:46012","PortSpecifier":{"PortValue":46012}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.59:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783446456,"nanos":117801836},"http":{"id":"2a05300b-a8a6-4956-8f1b-e0e7c1486248","method":"POST","headers":{":authority":"e2e-shared-a-19c9b1.apps.1d97bdc8-b55d-4428-9c0a-c26313fcaa60.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-19c9b1/rate-test-model-19c9b1/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T17:47:36Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"2a05300b-a8a6-4956-8f1b-e0e7c1486248","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-3UF9Ufkdr0pyv1KI_qxCIChFIde5yNvkkrUZcP4ux9IV52r6hEyIEZ14PCCP"}
{"level":"debug","ts":"2026-07-07T17:47:36Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"2a05300b-a8a6-4956-8f1b-e0e7c1486248","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-19c9b1.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-3UF9Ufkdr0pyv1KI_qxCIChFIde5yNvkkrUZcP4ux9IV52r6hEyIEZ14PCCP\"}"}
{"level":"debug","ts":"2026-07-07T17:47:36Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"2a05300b-a8a6-4956-8f1b-e0e7c1486248","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-19c9b1.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"b11d09b7-0e00-4b1b-af03-4603a413c962","keyName":"e2e-rate-a-0eb5de","subscription":"e2e-rate-iso-a-0eb5de","tenant":"e2e-shared-a-19c9b1","userId":"b11d09b7-0e00-4b1b-af03-4603a413c962","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-07T17:47:36Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"2a05300b-a8a6-4956-8f1b-e0e7c1486248","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-19c9b1.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-19c9b1/rate-test-model-19c9b1\",\"requestedSubscription\":\"e2e-rate-iso-a-0eb5de\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-07T17:47:36Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"2a05300b-a8a6-4956-8f1b-e0e7c1486248","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-19c9b1.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-19c9b1","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-0eb5de","namespace":"ai-tenant-e2e-shared-a-19c9b1","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-07T17:47:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"2a05300b-a8a6-4956-8f1b-e0e7c1486248","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T17:47:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2a05300b-a8a6-4956-8f1b-e0e7c1486248","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T17:47:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2a05300b-a8a6-4956-8f1b-e0e7c1486248","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T17:47:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2a05300b-a8a6-4956-8f1b-e0e7c1486248","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-19c9b1/rate-test-model-19c9b1\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T17:47:36Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2a05300b-a8a6-4956-8f1b-e0e7c1486248","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T17:47:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2a05300b-a8a6-4956-8f1b-e0e7c1486248","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-07T17:47:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2a05300b-a8a6-4956-8f1b-e0e7c1486248","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T17:47:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2a05300b-a8a6-4956-8f1b-e0e7c1486248","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-0eb5de"}
{"level":"debug","ts":"2026-07-07T17:47:36Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2a05300b-a8a6-4956-8f1b-e0e7c1486248","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"b11d09b7-0e00-4b1b-af03-4603a413c962","keyName":"e2e-rate-a-0eb5de","selected_subscription":"e2e-rate-iso-a-0eb5de","selected_subscription_key":"ai-tenant-e2e-shared-a-19c9b1/e2e-rate-iso-a-0eb5de@ai-tenant-e2e-shared-a-19c9b1/rate-test-model-19c9b1","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-19c9b1","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-0eb5de","namespace":"ai-tenant-e2e-shared-a-19c9b1","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-07T17:47:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2a05300b-a8a6-4956-8f1b-e0e7c1486248","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T17:47:36Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2a05300b-a8a6-4956-8f1b-e0e7c1486248","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T17:47:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d2d3c8f6-b8d7-4732-ad50-0ab55cc54723","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.10:46022","PortSpecifier":{"PortValue":46022}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.59:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"d2d3c8f6-b8d7-4732-ad50-0ab55cc54723","method":"POST","path":"/ai-tenant-e2e-shared-a-19c9b1/rate-test-model-19c9b1/v1/completions","host":"e2e-shared-a-19c9b1.apps.1d97bdc8-b55d-4428-9c0a-c26313fcaa60.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T17:47:37Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d2d3c8f6-b8d7-4732-ad50-0ab55cc54723","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.10:46022","PortSpecifier":{"PortValue":46022}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.59:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783446457,"nanos":158965182},"http":{"id":"d2d3c8f6-b8d7-4732-ad50-0ab55cc54723","method":"POST","headers":{":authority":"e2e-shared-a-19c9b1.apps.1d97bdc8-b55d-4428-9c0a-c26313fcaa60.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-19c9b1/rate-test-model-19c9b1/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T17:47:37Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"d2d3c8f6-b8d7-4732-ad50-0ab55cc54723","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-3UF9Ufkdr0pyv1KI_qxCIChFIde5yNvkkrUZcP4ux9IV52r6hEyIEZ14PCCP"}
{"level":"debug","ts":"2026-07-07T17:47:37Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"d2d3c8f6-b8d7-4732-ad50-0ab55cc54723","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-19c9b1.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-3UF9Ufkdr0pyv1KI_qxCIChFIde5yNvkkrUZcP4ux9IV52r6hEyIEZ14PCCP\"}"}
{"level":"debug","ts":"2026-07-07T17:47:37Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"d2d3c8f6-b8d7-4732-ad50-0ab55cc54723","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-19c9b1.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"b11d09b7-0e00-4b1b-af03-4603a413c962","keyName":"e2e-rate-a-0eb5de","subscription":"e2e-rate-iso-a-0eb5de","tenant":"e2e-shared-a-19c9b1","userId":"b11d09b7-0e00-4b1b-af03-4603a413c962","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-07T17:47:37Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"d2d3c8f6-b8d7-4732-ad50-0ab55cc54723","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-19c9b1.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-19c9b1/rate-test-model-19c9b1\",\"requestedSubscription\":\"e2e-rate-iso-a-0eb5de\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-07T17:47:37Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"d2d3c8f6-b8d7-4732-ad50-0ab55cc54723","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-19c9b1.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-19c9b1","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-0eb5de","namespace":"ai-tenant-e2e-shared-a-19c9b1","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-07T17:47:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"d2d3c8f6-b8d7-4732-ad50-0ab55cc54723","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T17:47:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d2d3c8f6-b8d7-4732-ad50-0ab55cc54723","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T17:47:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d2d3c8f6-b8d7-4732-ad50-0ab55cc54723","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T17:47:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d2d3c8f6-b8d7-4732-ad50-0ab55cc54723","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-19c9b1/rate-test-model-19c9b1\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T17:47:37Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d2d3c8f6-b8d7-4732-ad50-0ab55cc54723","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T17:47:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d2d3c8f6-b8d7-4732-ad50-0ab55cc54723","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T17:47:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d2d3c8f6-b8d7-4732-ad50-0ab55cc54723","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-07T17:47:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d2d3c8f6-b8d7-4732-ad50-0ab55cc54723","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-0eb5de"}
{"level":"debug","ts":"2026-07-07T17:47:37Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d2d3c8f6-b8d7-4732-ad50-0ab55cc54723","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"b11d09b7-0e00-4b1b-af03-4603a413c962","keyName":"e2e-rate-a-0eb5de","selected_subscription":"e2e-rate-iso-a-0eb5de","selected_subscription_key":"ai-tenant-e2e-shared-a-19c9b1/e2e-rate-iso-a-0eb5de@ai-tenant-e2e-shared-a-19c9b1/rate-test-model-19c9b1","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-19c9b1","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-0eb5de","namespace":"ai-tenant-e2e-shared-a-19c9b1","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-07T17:47:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d2d3c8f6-b8d7-4732-ad50-0ab55cc54723","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T17:47:37Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d2d3c8f6-b8d7-4732-ad50-0ab55cc54723","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T17:47:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c547d719-f5f2-4680-8e88-fda7fdeda875","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.10:46036","PortSpecifier":{"PortValue":46036}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.59:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"c547d719-f5f2-4680-8e88-fda7fdeda875","method":"POST","path":"/ai-tenant-e2e-shared-a-19c9b1/rate-test-model-19c9b1/v1/completions","host":"e2e-shared-a-19c9b1.apps.1d97bdc8-b55d-4428-9c0a-c26313fcaa60.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T17:47:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c547d719-f5f2-4680-8e88-fda7fdeda875","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.10:46036","PortSpecifier":{"PortValue":46036}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.59:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783446458,"nanos":199429326},"http":{"id":"c547d719-f5f2-4680-8e88-fda7fdeda875","method":"POST","headers":{":authority":"e2e-shared-a-19c9b1.apps.1d97bdc8-b55d-4428-9c0a-c26313fcaa60.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-19c9b1/rate-test-model-19c9b1/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T17:47:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"c547d719-f5f2-4680-8e88-fda7fdeda875","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-3UF9Ufkdr0pyv1KI_qxCIChFIde5yNvkkrUZcP4ux9IV52r6hEyIEZ14PCCP"}
{"level":"debug","ts":"2026-07-07T17:47:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"c547d719-f5f2-4680-8e88-fda7fdeda875","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-19c9b1.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-3UF9Ufkdr0pyv1KI_qxCIChFIde5yNvkkrUZcP4ux9IV52r6hEyIEZ14PCCP\"}"}
{"level":"debug","ts":"2026-07-07T17:47:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"c547d719-f5f2-4680-8e88-fda7fdeda875","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-19c9b1.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"b11d09b7-0e00-4b1b-af03-4603a413c962","keyName":"e2e-rate-a-0eb5de","subscription":"e2e-rate-iso-a-0eb5de","tenant":"e2e-shared-a-19c9b1","userId":"b11d09b7-0e00-4b1b-af03-4603a413c962","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-07T17:47:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"c547d719-f5f2-4680-8e88-fda7fdeda875","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-19c9b1.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-19c9b1/rate-test-model-19c9b1\",\"requestedSubscription\":\"e2e-rate-iso-a-0eb5de\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-07T17:47:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"c547d719-f5f2-4680-8e88-fda7fdeda875","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-19c9b1.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-19c9b1","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-0eb5de","namespace":"ai-tenant-e2e-shared-a-19c9b1","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-07T17:47:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"c547d719-f5f2-4680-8e88-fda7fdeda875","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T17:47:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c547d719-f5f2-4680-8e88-fda7fdeda875","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T17:47:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c547d719-f5f2-4680-8e88-fda7fdeda875","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T17:47:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c547d719-f5f2-4680-8e88-fda7fdeda875","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-19c9b1/rate-test-model-19c9b1\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T17:47:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c547d719-f5f2-4680-8e88-fda7fdeda875","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T17:47:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c547d719-f5f2-4680-8e88-fda7fdeda875","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T17:47:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c547d719-f5f2-4680-8e88-fda7fdeda875","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-07T17:47:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c547d719-f5f2-4680-8e88-fda7fdeda875","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-0eb5de"}
{"level":"debug","ts":"2026-07-07T17:47:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c547d719-f5f2-4680-8e88-fda7fdeda875","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"b11d09b7-0e00-4b1b-af03-4603a413c962","keyName":"e2e-rate-a-0eb5de","selected_subscription":"e2e-rate-iso-a-0eb5de","selected_subscription_key":"ai-tenant-e2e-shared-a-19c9b1/e2e-rate-iso-a-0eb5de@ai-tenant-e2e-shared-a-19c9b1/rate-test-model-19c9b1","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-19c9b1","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-0eb5de","namespace":"ai-tenant-e2e-shared-a-19c9b1","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-07T17:47:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c547d719-f5f2-4680-8e88-fda7fdeda875","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T17:47:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c547d719-f5f2-4680-8e88-fda7fdeda875","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T17:47:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7cb7115c-457e-46b9-84be-b7bf77742e2d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.10:46048","PortSpecifier":{"PortValue":46048}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.59:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"7cb7115c-457e-46b9-84be-b7bf77742e2d","method":"POST","path":"/ai-tenant-e2e-shared-a-19c9b1/rate-test-model-19c9b1/v1/completions","host":"e2e-shared-a-19c9b1.apps.1d97bdc8-b55d-4428-9c0a-c26313fcaa60.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T17:47:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"7cb7115c-457e-46b9-84be-b7bf77742e2d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.10:46048","PortSpecifier":{"PortValue":46048}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.59:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783446459,"nanos":237426029},"http":{"id":"7cb7115c-457e-46b9-84be-b7bf77742e2d","method":"POST","headers":{":authority":"e2e-shared-a-19c9b1.apps.1d97bdc8-b55d-4428-9c0a-c26313fcaa60.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-19c9b1/rate-test-model-19c9b1/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T17:47:39Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"7cb7115c-457e-46b9-84be-b7bf77742e2d","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-3UF9Ufkdr0pyv1KI_qxCIChFIde5yNvkkrUZcP4ux9IV52r6hEyIEZ14PCCP"}
{"level":"debug","ts":"2026-07-07T17:47:39Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"7cb7115c-457e-46b9-84be-b7bf77742e2d","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-19c9b1.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-3UF9Ufkdr0pyv1KI_qxCIChFIde5yNvkkrUZcP4ux9IV52r6hEyIEZ14PCCP\"}"}
{"level":"debug","ts":"2026-07-07T17:47:39Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"7cb7115c-457e-46b9-84be-b7bf77742e2d","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-19c9b1.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"b11d09b7-0e00-4b1b-af03-4603a413c962","keyName":"e2e-rate-a-0eb5de","subscription":"e2e-rate-iso-a-0eb5de","tenant":"e2e-shared-a-19c9b1","userId":"b11d09b7-0e00-4b1b-af03-4603a413c962","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-07T17:47:39Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"7cb7115c-457e-46b9-84be-b7bf77742e2d","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-19c9b1.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-19c9b1/rate-test-model-19c9b1\",\"requestedSubscription\":\"e2e-rate-iso-a-0eb5de\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-07T17:47:39Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"7cb7115c-457e-46b9-84be-b7bf77742e2d","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-19c9b1.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-19c9b1","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-0eb5de","namespace":"ai-tenant-e2e-shared-a-19c9b1","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-07T17:47:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"7cb7115c-457e-46b9-84be-b7bf77742e2d","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T17:47:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7cb7115c-457e-46b9-84be-b7bf77742e2d","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T17:47:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7cb7115c-457e-46b9-84be-b7bf77742e2d","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T17:47:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7cb7115c-457e-46b9-84be-b7bf77742e2d","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-19c9b1/rate-test-model-19c9b1\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T17:47:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"7cb7115c-457e-46b9-84be-b7bf77742e2d","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T17:47:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7cb7115c-457e-46b9-84be-b7bf77742e2d","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T17:47:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7cb7115c-457e-46b9-84be-b7bf77742e2d","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-07T17:47:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7cb7115c-457e-46b9-84be-b7bf77742e2d","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-0eb5de"}
{"level":"debug","ts":"2026-07-07T17:47:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"7cb7115c-457e-46b9-84be-b7bf77742e2d","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"b11d09b7-0e00-4b1b-af03-4603a413c962","keyName":"e2e-rate-a-0eb5de","selected_subscription":"e2e-rate-iso-a-0eb5de","selected_subscription_key":"ai-tenant-e2e-shared-a-19c9b1/e2e-rate-iso-a-0eb5de@ai-tenant-e2e-shared-a-19c9b1/rate-test-model-19c9b1","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-19c9b1","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-0eb5de","namespace":"ai-tenant-e2e-shared-a-19c9b1","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-07T17:47:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7cb7115c-457e-46b9-84be-b7bf77742e2d","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T17:47:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"7cb7115c-457e-46b9-84be-b7bf77742e2d","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T17:47:40Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"dc220ea7-ea44-420a-a899-e1b7fd92c1a2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.10:46058","PortSpecifier":{"PortValue":46058}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.59:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"dc220ea7-ea44-420a-a899-e1b7fd92c1a2","method":"POST","path":"/ai-tenant-e2e-shared-a-19c9b1/rate-test-model-19c9b1/v1/completions","host":"e2e-shared-a-19c9b1.apps.1d97bdc8-b55d-4428-9c0a-c26313fcaa60.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T17:47:40Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"dc220ea7-ea44-420a-a899-e1b7fd92c1a2","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.10:46058","PortSpecifier":{"PortValue":46058}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.59:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783446460,"nanos":276912441},"http":{"id":"dc220ea7-ea44-420a-a899-e1b7fd92c1a2","method":"POST","headers":{":authority":"e2e-shared-a-19c9b1.apps.1d97bdc8-b55d-4428-9c0a-c26313fcaa60.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-19c9b1/rate-test-model-19c9b1/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T17:47:40Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"dc220ea7-ea44-420a-a899-e1b7fd92c1a2","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-3UF9Ufkdr0pyv1KI_qxCIChFIde5yNvkkrUZcP4ux9IV52r6hEyIEZ14PCCP"}
{"level":"debug","ts":"2026-07-07T17:47:40Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"dc220ea7-ea44-420a-a899-e1b7fd92c1a2","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-19c9b1.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-3UF9Ufkdr0pyv1KI_qxCIChFIde5yNvkkrUZcP4ux9IV52r6hEyIEZ14PCCP\"}"}
{"level":"debug","ts":"2026-07-07T17:47:40Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"dc220ea7-ea44-420a-a899-e1b7fd92c1a2","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-19c9b1.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"b11d09b7-0e00-4b1b-af03-4603a413c962","keyName":"e2e-rate-a-0eb5de","subscription":"e2e-rate-iso-a-0eb5de","tenant":"e2e-shared-a-19c9b1","userId":"b11d09b7-0e00-4b1b-af03-4603a413c962","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-07T17:47:40Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"dc220ea7-ea44-420a-a899-e1b7fd92c1a2","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-19c9b1.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-19c9b1/rate-test-model-19c9b1\",\"requestedSubscription\":\"e2e-rate-iso-a-0eb5de\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-07T17:47:40Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"dc220ea7-ea44-420a-a899-e1b7fd92c1a2","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-19c9b1.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-19c9b1","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-0eb5de","namespace":"ai-tenant-e2e-shared-a-19c9b1","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-07T17:47:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"dc220ea7-ea44-420a-a899-e1b7fd92c1a2","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T17:47:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"dc220ea7-ea44-420a-a899-e1b7fd92c1a2","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T17:47:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"dc220ea7-ea44-420a-a899-e1b7fd92c1a2","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T17:47:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"dc220ea7-ea44-420a-a899-e1b7fd92c1a2","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T17:47:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"dc220ea7-ea44-420a-a899-e1b7fd92c1a2","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-19c9b1/rate-test-model-19c9b1\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T17:47:40Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"dc220ea7-ea44-420a-a899-e1b7fd92c1a2","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T17:47:40Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"dc220ea7-ea44-420a-a899-e1b7fd92c1a2","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-0eb5de"}
{"level":"debug","ts":"2026-07-07T17:47:40Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"dc220ea7-ea44-420a-a899-e1b7fd92c1a2","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-07T17:47:40Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"dc220ea7-ea44-420a-a899-e1b7fd92c1a2","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"b11d09b7-0e00-4b1b-af03-4603a413c962","keyName":"e2e-rate-a-0eb5de","selected_subscription":"e2e-rate-iso-a-0eb5de","selected_subscription_key":"ai-tenant-e2e-shared-a-19c9b1/e2e-rate-iso-a-0eb5de@ai-tenant-e2e-shared-a-19c9b1/rate-test-model-19c9b1","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-19c9b1","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-0eb5de","namespace":"ai-tenant-e2e-shared-a-19c9b1","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-07T17:47:40Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"dc220ea7-ea44-420a-a899-e1b7fd92c1a2","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T17:47:40Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"dc220ea7-ea44-420a-a899-e1b7fd92c1a2","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T17:47:41Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a9c6106a-82b9-4145-ab6f-ed81abff796e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.10:46068","PortSpecifier":{"PortValue":46068}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.59:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"a9c6106a-82b9-4145-ab6f-ed81abff796e","method":"POST","path":"/ai-tenant-e2e-shared-a-19c9b1/rate-test-model-19c9b1/v1/completions","host":"e2e-shared-a-19c9b1.apps.1d97bdc8-b55d-4428-9c0a-c26313fcaa60.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T17:47:41Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a9c6106a-82b9-4145-ab6f-ed81abff796e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.10:46068","PortSpecifier":{"PortValue":46068}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.59:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783446461,"nanos":317539394},"http":{"id":"a9c6106a-82b9-4145-ab6f-ed81abff796e","method":"POST","headers":{":authority":"e2e-shared-a-19c9b1.apps.1d97bdc8-b55d-4428-9c0a-c26313fcaa60.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-19c9b1/rate-test-model-19c9b1/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T17:47:41Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"a9c6106a-82b9-4145-ab6f-ed81abff796e","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-3UF9Ufkdr0pyv1KI_qxCIChFIde5yNvkkrUZcP4ux9IV52r6hEyIEZ14PCCP"}
{"level":"debug","ts":"2026-07-07T17:47:41Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a9c6106a-82b9-4145-ab6f-ed81abff796e","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-19c9b1.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-3UF9Ufkdr0pyv1KI_qxCIChFIde5yNvkkrUZcP4ux9IV52r6hEyIEZ14PCCP\"}"}
{"level":"debug","ts":"2026-07-07T17:47:41Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a9c6106a-82b9-4145-ab6f-ed81abff796e","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-19c9b1.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"b11d09b7-0e00-4b1b-af03-4603a413c962","keyName":"e2e-rate-a-0eb5de","subscription":"e2e-rate-iso-a-0eb5de","tenant":"e2e-shared-a-19c9b1","userId":"b11d09b7-0e00-4b1b-af03-4603a413c962","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-07T17:47:41Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a9c6106a-82b9-4145-ab6f-ed81abff796e","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-19c9b1.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-19c9b1/rate-test-model-19c9b1\",\"requestedSubscription\":\"e2e-rate-iso-a-0eb5de\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-07T17:47:41Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a9c6106a-82b9-4145-ab6f-ed81abff796e","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-19c9b1.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-19c9b1","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-0eb5de","namespace":"ai-tenant-e2e-shared-a-19c9b1","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-07T17:47:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"a9c6106a-82b9-4145-ab6f-ed81abff796e","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T17:47:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a9c6106a-82b9-4145-ab6f-ed81abff796e","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T17:47:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a9c6106a-82b9-4145-ab6f-ed81abff796e","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T17:47:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a9c6106a-82b9-4145-ab6f-ed81abff796e","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T17:47:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a9c6106a-82b9-4145-ab6f-ed81abff796e","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-19c9b1/rate-test-model-19c9b1\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T17:47:41Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a9c6106a-82b9-4145-ab6f-ed81abff796e","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-07T17:47:41Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a9c6106a-82b9-4145-ab6f-ed81abff796e","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T17:47:41Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a9c6106a-82b9-4145-ab6f-ed81abff796e","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-0eb5de"}
{"level":"debug","ts":"2026-07-07T17:47:41Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a9c6106a-82b9-4145-ab6f-ed81abff796e","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"b11d09b7-0e00-4b1b-af03-4603a413c962","keyName":"e2e-rate-a-0eb5de","selected_subscription":"e2e-rate-iso-a-0eb5de","selected_subscription_key":"ai-tenant-e2e-shared-a-19c9b1/e2e-rate-iso-a-0eb5de@ai-tenant-e2e-shared-a-19c9b1/rate-test-model-19c9b1","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-19c9b1","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-0eb5de","namespace":"ai-tenant-e2e-shared-a-19c9b1","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-07T17:47:41Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a9c6106a-82b9-4145-ab6f-ed81abff796e","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T17:47:41Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a9c6106a-82b9-4145-ab6f-ed81abff796e","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T17:47:42Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"cfeef416-9687-452f-bbab-f74b69cf0255","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.10:46078","PortSpecifier":{"PortValue":46078}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.59:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"cfeef416-9687-452f-bbab-f74b69cf0255","method":"POST","path":"/ai-tenant-e2e-shared-a-19c9b1/rate-test-model-19c9b1/v1/completions","host":"e2e-shared-a-19c9b1.apps.1d97bdc8-b55d-4428-9c0a-c26313fcaa60.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T17:47:42Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"cfeef416-9687-452f-bbab-f74b69cf0255","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.10:46078","PortSpecifier":{"PortValue":46078}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.59:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783446462,"nanos":357508832},"http":{"id":"cfeef416-9687-452f-bbab-f74b69cf0255","method":"POST","headers":{":authority":"e2e-shared-a-19c9b1.apps.1d97bdc8-b55d-4428-9c0a-c26313fcaa60.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-19c9b1/rate-test-model-19c9b1/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T17:47:42Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"cfeef416-9687-452f-bbab-f74b69cf0255","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-3UF9Ufkdr0pyv1KI_qxCIChFIde5yNvkkrUZcP4ux9IV52r6hEyIEZ14PCCP"}
{"level":"debug","ts":"2026-07-07T17:47:42Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"cfeef416-9687-452f-bbab-f74b69cf0255","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-19c9b1.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-3UF9Ufkdr0pyv1KI_qxCIChFIde5yNvkkrUZcP4ux9IV52r6hEyIEZ14PCCP\"}"}
{"level":"debug","ts":"2026-07-07T17:47:42Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"cfeef416-9687-452f-bbab-f74b69cf0255","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-19c9b1.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"b11d09b7-0e00-4b1b-af03-4603a413c962","keyName":"e2e-rate-a-0eb5de","subscription":"e2e-rate-iso-a-0eb5de","tenant":"e2e-shared-a-19c9b1","userId":"b11d09b7-0e00-4b1b-af03-4603a413c962","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-07T17:47:42Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"cfeef416-9687-452f-bbab-f74b69cf0255","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-19c9b1.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-19c9b1/rate-test-model-19c9b1\",\"requestedSubscription\":\"e2e-rate-iso-a-0eb5de\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-07T17:47:42Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"cfeef416-9687-452f-bbab-f74b69cf0255","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-19c9b1.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-19c9b1","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-0eb5de","namespace":"ai-tenant-e2e-shared-a-19c9b1","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-07T17:47:42Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"cfeef416-9687-452f-bbab-f74b69cf0255","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T17:47:42Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cfeef416-9687-452f-bbab-f74b69cf0255","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T17:47:42Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cfeef416-9687-452f-bbab-f74b69cf0255","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T17:47:42Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cfeef416-9687-452f-bbab-f74b69cf0255","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T17:47:42Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"cfeef416-9687-452f-bbab-f74b69cf0255","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-19c9b1/rate-test-model-19c9b1\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T17:47:42Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cfeef416-9687-452f-bbab-f74b69cf0255","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-0eb5de"}
{"level":"debug","ts":"2026-07-07T17:47:42Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cfeef416-9687-452f-bbab-f74b69cf0255","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T17:47:42Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cfeef416-9687-452f-bbab-f74b69cf0255","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-07T17:47:42Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"cfeef416-9687-452f-bbab-f74b69cf0255","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"b11d09b7-0e00-4b1b-af03-4603a413c962","keyName":"e2e-rate-a-0eb5de","selected_subscription":"e2e-rate-iso-a-0eb5de","selected_subscription_key":"ai-tenant-e2e-shared-a-19c9b1/e2e-rate-iso-a-0eb5de@ai-tenant-e2e-shared-a-19c9b1/rate-test-model-19c9b1","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-19c9b1","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-0eb5de","namespace":"ai-tenant-e2e-shared-a-19c9b1","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-07T17:47:42Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"cfeef416-9687-452f-bbab-f74b69cf0255","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T17:47:42Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"cfeef416-9687-452f-bbab-f74b69cf0255","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T17:47:43Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a232977e-a8dc-4fca-ad66-146d7a804348","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.10:47958","PortSpecifier":{"PortValue":47958}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.59:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"a232977e-a8dc-4fca-ad66-146d7a804348","method":"POST","path":"/ai-tenant-e2e-shared-a-19c9b1/rate-test-model-19c9b1/v1/completions","host":"e2e-shared-a-19c9b1.apps.1d97bdc8-b55d-4428-9c0a-c26313fcaa60.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T17:47:43Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a232977e-a8dc-4fca-ad66-146d7a804348","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.10:47958","PortSpecifier":{"PortValue":47958}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.59:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783446463,"nanos":391645953},"http":{"id":"a232977e-a8dc-4fca-ad66-146d7a804348","method":"POST","headers":{":authority":"e2e-shared-a-19c9b1.apps.1d97bdc8-b55d-4428-9c0a-c26313fcaa60.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-19c9b1/rate-test-model-19c9b1/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T17:47:43Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"a232977e-a8dc-4fca-ad66-146d7a804348","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-3UF9Ufkdr0pyv1KI_qxCIChFIde5yNvkkrUZcP4ux9IV52r6hEyIEZ14PCCP"}
{"level":"debug","ts":"2026-07-07T17:47:43Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a232977e-a8dc-4fca-ad66-146d7a804348","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-19c9b1.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-3UF9Ufkdr0pyv1KI_qxCIChFIde5yNvkkrUZcP4ux9IV52r6hEyIEZ14PCCP\"}"}
{"level":"debug","ts":"2026-07-07T17:47:43Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a232977e-a8dc-4fca-ad66-146d7a804348","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-19c9b1.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"b11d09b7-0e00-4b1b-af03-4603a413c962","keyName":"e2e-rate-a-0eb5de","subscription":"e2e-rate-iso-a-0eb5de","tenant":"e2e-shared-a-19c9b1","userId":"b11d09b7-0e00-4b1b-af03-4603a413c962","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-07T17:47:43Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a232977e-a8dc-4fca-ad66-146d7a804348","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-19c9b1.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-19c9b1/rate-test-model-19c9b1\",\"requestedSubscription\":\"e2e-rate-iso-a-0eb5de\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-07T17:47:43Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a232977e-a8dc-4fca-ad66-146d7a804348","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-19c9b1.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-19c9b1","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-0eb5de","namespace":"ai-tenant-e2e-shared-a-19c9b1","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-07T17:47:43Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"a232977e-a8dc-4fca-ad66-146d7a804348","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T17:47:43Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a232977e-a8dc-4fca-ad66-146d7a804348","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T17:47:43Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a232977e-a8dc-4fca-ad66-146d7a804348","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T17:47:43Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a232977e-a8dc-4fca-ad66-146d7a804348","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T17:47:43Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a232977e-a8dc-4fca-ad66-146d7a804348","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-19c9b1/rate-test-model-19c9b1\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T17:47:43Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a232977e-a8dc-4fca-ad66-146d7a804348","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T17:47:43Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a232977e-a8dc-4fca-ad66-146d7a804348","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-0eb5de"}
{"level":"debug","ts":"2026-07-07T17:47:43Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a232977e-a8dc-4fca-ad66-146d7a804348","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-07T17:47:43Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a232977e-a8dc-4fca-ad66-146d7a804348","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"b11d09b7-0e00-4b1b-af03-4603a413c962","keyName":"e2e-rate-a-0eb5de","selected_subscription":"e2e-rate-iso-a-0eb5de","selected_subscription_key":"ai-tenant-e2e-shared-a-19c9b1/e2e-rate-iso-a-0eb5de@ai-tenant-e2e-shared-a-19c9b1/rate-test-model-19c9b1","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-19c9b1","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-0eb5de","namespace":"ai-tenant-e2e-shared-a-19c9b1","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-07T17:47:43Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a232977e-a8dc-4fca-ad66-146d7a804348","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T17:47:43Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a232977e-a8dc-4fca-ad66-146d7a804348","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T17:47:43Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d97ef2e4-d2ce-4580-93b6-08d6620f39ff","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.10:59458","PortSpecifier":{"PortValue":59458}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.38:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"d97ef2e4-d2ce-4580-93b6-08d6620f39ff","method":"POST","path":"/ai-tenant-e2e-shared-b-ce87c9/rate-test-model-ce87c9/v1/completions","host":"e2e-shared-b-ce87c9.apps.1d97bdc8-b55d-4428-9c0a-c26313fcaa60.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-07T17:47:43Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d97ef2e4-d2ce-4580-93b6-08d6620f39ff","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.10:59458","PortSpecifier":{"PortValue":59458}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.38:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783446463,"nanos":431046488},"http":{"id":"d97ef2e4-d2ce-4580-93b6-08d6620f39ff","method":"POST","headers":{":authority":"e2e-shared-b-ce87c9.apps.1d97bdc8-b55d-4428-9c0a-c26313fcaa60.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-b-ce87c9/rate-test-model-ce87c9/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T17:47:43Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"d97ef2e4-d2ce-4580-93b6-08d6620f39ff","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-zqr3ZoXVMcoEwmin_13uLE2t6jPBDrkJfwUgM4UWanCxiD3kTXfhu9y7cPu7"}
{"level":"debug","ts":"2026-07-07T17:47:43Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"d97ef2e4-d2ce-4580-93b6-08d6620f39ff","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-b-ce87c9.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-zqr3ZoXVMcoEwmin_13uLE2t6jPBDrkJfwUgM4UWanCxiD3kTXfhu9y7cPu7\"}"}
{"level":"debug","ts":"2026-07-07T17:47:43Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"d97ef2e4-d2ce-4580-93b6-08d6620f39ff","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-ce87c9.opendatahub.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"43ae24e0-6f15-4772-bd7a-50b32e6a4010","keyName":"e2e-rate-b-0eb5de","subscription":"e2e-rate-iso-b-0eb5de","tenant":"e2e-shared-b-ce87c9","userId":"43ae24e0-6f15-4772-bd7a-50b32e6a4010","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-07T17:47:43Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"d97ef2e4-d2ce-4580-93b6-08d6620f39ff","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-b-ce87c9.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-b-ce87c9/rate-test-model-ce87c9\",\"requestedSubscription\":\"e2e-rate-iso-b-0eb5de\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-07T17:47:43Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"d97ef2e4-d2ce-4580-93b6-08d6620f39ff","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-ce87c9.opendatahub.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-ce87c9","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-0eb5de","namespace":"ai-tenant-e2e-shared-b-ce87c9","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-07T17:47:43Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"d97ef2e4-d2ce-4580-93b6-08d6620f39ff","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-07T17:47:43Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d97ef2e4-d2ce-4580-93b6-08d6620f39ff","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T17:47:43Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d97ef2e4-d2ce-4580-93b6-08d6620f39ff","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T17:47:43Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d97ef2e4-d2ce-4580-93b6-08d6620f39ff","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-ce87c9/rate-test-model-ce87c9\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T17:47:43Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d97ef2e4-d2ce-4580-93b6-08d6620f39ff","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-07T17:47:43Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d97ef2e4-d2ce-4580-93b6-08d6620f39ff","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-07T17:47:43Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d97ef2e4-d2ce-4580-93b6-08d6620f39ff","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-b-0eb5de"}
{"level":"debug","ts":"2026-07-07T17:47:43Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d97ef2e4-d2ce-4580-93b6-08d6620f39ff","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-07T17:47:43Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d97ef2e4-d2ce-4580-93b6-08d6620f39ff","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"43ae24e0-6f15-4772-bd7a-50b32e6a4010","keyName":"e2e-rate-b-0eb5de","selected_subscription":"e2e-rate-iso-b-0eb5de","selected_subscription_key":"ai-tenant-e2e-shared-b-ce87c9/e2e-rate-iso-b-0eb5de@ai-tenant-e2e-shared-b-ce87c9/rate-test-model-ce87c9","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-ce87c9","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-0eb5de","namespace":"ai-tenant-e2e-shared-b-ce87c9","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-07T17:47:43Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d97ef2e4-d2ce-4580-93b6-08d6620f39ff","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-07T17:47:43Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d97ef2e4-d2ce-4580-93b6-08d6620f39ff","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-07T17:47:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/ebe092ef797333c678bf90cc592fa1b8100c05b1a652e3720595563b89dcc442"}
{"level":"info","ts":"2026-07-07T17:47:50Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/0a33e88fb8a6bad06d34e77f290e999d360e20ee1485ebfa18dbce2ee297666f"}
{"level":"info","ts":"2026-07-07T17:47:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/1de2c521ad4d2f13175c4a163f70eaf72310b2388c3672e7c42a9b7df959a3de"}
{"level":"info","ts":"2026-07-07T17:47:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/e35dd82c5f507a8ec7a0c3addde269457b4ed249572e80e8920fa3b1ecacdcda"}
{"level":"info","ts":"2026-07-07T17:47:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/cde74f5de53e77d196a3aabf0abe3ce1507be42659b509a031e6951a70eae6ed"}
{"level":"info","ts":"2026-07-07T17:47:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/73b5c4a83f30d3e11ab6ee2d6681e8ac53330e37c3bc51d5d25c29d25aa064c6"}
{"level":"info","ts":"2026-07-07T17:47:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/4e2f8ee94fdcc577ae36273e7865ddc6628e7978cecea31e36afaabaa73f59e7"}
{"level":"info","ts":"2026-07-07T17:47:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/1711770c354883dcc1cb93d0d03a753703b46da1c1ce46eeb1a2bda55e55b4dd"}
{"level":"info","ts":"2026-07-07T17:47:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/597c93ad52d13f8f9546c1f288952a470b1cbaa119def99c8ff4f25164de8787"}
{"level":"info","ts":"2026-07-07T17:47:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/31d806710f35ce7ff75094aab8c317a486fcc45cef199a7196efeaddfad777ef"}
{"level":"info","ts":"2026-07-07T17:47:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/221a9bd70341311fc5cc0dc86ae2f43461a4902d7bbbb6e9537fca0495b1bfc9"}
{"level":"info","ts":"2026-07-07T17:47:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/7fe0d80bd3060a4b116a3a1e875b9e1424fb9f3ad1889f2b6600d7b98ab0cfe1"}
{"level":"info","ts":"2026-07-07T17:47:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/b9ebfcb56afbb067c20781282a3a25e427d64ac1f133062212f269f94775542e"}
{"level":"info","ts":"2026-07-07T17:47:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/2616a94aed0781c95a8b1dadc81e4317fa9558b2ccf4637f4b7332de68035f14"}
{"level":"info","ts":"2026-07-07T17:47:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/f2075297ed7421c5919479862eaa011c0cb7cd93e5f7a6db054e83dd768a2ad0"}
{"level":"info","ts":"2026-07-07T17:47:51Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/322586a5dae66b6b4722626aec3cbf7c7ce9b94039e8b76acef1b27f27b7b0f2"}
{"level":"info","ts":"2026-07-07T17:48:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/1c50221d222fb7b8ff4e11098df6b62d7b0c78ec2bc8847434de1ac76313f7c8"}
{"level":"info","ts":"2026-07-07T17:48:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/ce6a24861f2e3d59dfe44943df9ca381d708e599247246eba240175ee5c6ffb0"}
{"level":"info","ts":"2026-07-07T17:48:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/442d566dec4dad9158d3574e413880479effad04ebc5220720f2ee87a5f9fab6"}
{"level":"info","ts":"2026-07-07T17:48:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/c1e7b3a36be8c501c2188990da07a0ec67d60ec50ce7566c918eb44876872137"}
{"level":"info","ts":"2026-07-07T17:48:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/ee5c8259cb0c30598dbdb5dc2df20f5a44ba138c5da30bfe6cabf955e681707d"}
{"level":"info","ts":"2026-07-07T17:48:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/86d92ea941495ba23e0743303ffd07e32188c7eec7ce21d8939a5447d2deed4a"}
{"level":"info","ts":"2026-07-07T17:48:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/00760d4002d15857a8c7f9f5289c07006c221ca2d0077384071333e4894d149c"}
{"level":"info","ts":"2026-07-07T17:48:17Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/e0f8e20e049197b76ebeac4abe24f913efd1e862a1a1ff6ba439b4ecc04dfe06"}