{"level":"debug","ts":"2026-07-28T21:37:24Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"b9e7df86-bc08-4fae-8d52-2d18b4960fd3","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T21:37:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b9e7df86-bc08-4fae-8d52-2d18b4960fd3","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-28T21:37:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b9e7df86-bc08-4fae-8d52-2d18b4960fd3","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-e56e5b"}
{"level":"debug","ts":"2026-07-28T21:37:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b9e7df86-bc08-4fae-8d52-2d18b4960fd3","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-28T21:37:24Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"b9e7df86-bc08-4fae-8d52-2d18b4960fd3","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"0b3b249a-6378-491e-a6cd-9c185ff82c19","keyName":"e2e-rate-a-e56e5b","selected_subscription":"e2e-rate-iso-a-e56e5b","selected_subscription_key":"ai-tenant-e2e-shared-a-1096ca/e2e-rate-iso-a-e56e5b@ai-tenant-e2e-shared-a-1096ca/rate-test-model-1096ca","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-1096ca/models/facebook/opt-125m","name":"rate-test-model-1096ca","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e56e5b","namespace":"ai-tenant-e2e-shared-a-1096ca","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-1096ca/rate-test-model-1096ca"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-28T21:37:24Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b9e7df86-bc08-4fae-8d52-2d18b4960fd3","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-28T21:37:24Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"b9e7df86-bc08-4fae-8d52-2d18b4960fd3","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-28T21:37:25Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"23bdcbdd-5260-4452-9dda-cedcc234475a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.12:53534","PortSpecifier":{"PortValue":53534}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.70:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"23bdcbdd-5260-4452-9dda-cedcc234475a","method":"POST","path":"/ai-tenant-e2e-shared-a-1096ca/rate-test-model-1096ca/v1/completions","host":"e2e-shared-a-1096ca.apps.0d3a9b4b-eea4-4a9a-bf7c-8164c97d3cb1.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-28T21:37:25Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"23bdcbdd-5260-4452-9dda-cedcc234475a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.12:53534","PortSpecifier":{"PortValue":53534}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.70:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785274645,"nanos":922979085},"http":{"id":"23bdcbdd-5260-4452-9dda-cedcc234475a","method":"POST","headers":{":authority":"e2e-shared-a-1096ca.apps.0d3a9b4b-eea4-4a9a-bf7c-8164c97d3cb1.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-1096ca/rate-test-model-1096ca/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T21:37:25Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"23bdcbdd-5260-4452-9dda-cedcc234475a","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-Pnj12BU2B3osCBNG_xibDmTsJFj95dzDLUg5BFRun8MkwhCW4dnEFNZ8Gt6R"}
{"level":"debug","ts":"2026-07-28T21:37:25Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"23bdcbdd-5260-4452-9dda-cedcc234475a","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-1096ca.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-Pnj12BU2B3osCBNG_xibDmTsJFj95dzDLUg5BFRun8MkwhCW4dnEFNZ8Gt6R\"}"}
{"level":"debug","ts":"2026-07-28T21:37:25Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"23bdcbdd-5260-4452-9dda-cedcc234475a","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1096ca.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"0b3b249a-6378-491e-a6cd-9c185ff82c19","keyName":"e2e-rate-a-e56e5b","subscription":"e2e-rate-iso-a-e56e5b","tenant":"e2e-shared-a-1096ca","userId":"0b3b249a-6378-491e-a6cd-9c185ff82c19","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-28T21:37:25Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"23bdcbdd-5260-4452-9dda-cedcc234475a","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-1096ca.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-1096ca/rate-test-model-1096ca\",\"requestedSubscription\":\"e2e-rate-iso-a-e56e5b\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-28T21:37:25Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"23bdcbdd-5260-4452-9dda-cedcc234475a","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1096ca.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-1096ca/models/facebook/opt-125m","name":"rate-test-model-1096ca","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e56e5b","namespace":"ai-tenant-e2e-shared-a-1096ca","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-1096ca/rate-test-model-1096ca"}}
{"level":"debug","ts":"2026-07-28T21:37:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"23bdcbdd-5260-4452-9dda-cedcc234475a","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T21:37:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"23bdcbdd-5260-4452-9dda-cedcc234475a","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T21:37:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"23bdcbdd-5260-4452-9dda-cedcc234475a","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T21:37:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"23bdcbdd-5260-4452-9dda-cedcc234475a","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-1096ca/rate-test-model-1096ca\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-1096ca/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T21:37:25Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"23bdcbdd-5260-4452-9dda-cedcc234475a","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T21:37:25Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"23bdcbdd-5260-4452-9dda-cedcc234475a","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-28T21:37:25Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"23bdcbdd-5260-4452-9dda-cedcc234475a","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-28T21:37:25Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"23bdcbdd-5260-4452-9dda-cedcc234475a","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-e56e5b"}
{"level":"debug","ts":"2026-07-28T21:37:25Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"23bdcbdd-5260-4452-9dda-cedcc234475a","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"0b3b249a-6378-491e-a6cd-9c185ff82c19","keyName":"e2e-rate-a-e56e5b","selected_subscription":"e2e-rate-iso-a-e56e5b","selected_subscription_key":"ai-tenant-e2e-shared-a-1096ca/e2e-rate-iso-a-e56e5b@ai-tenant-e2e-shared-a-1096ca/rate-test-model-1096ca","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-1096ca/models/facebook/opt-125m","name":"rate-test-model-1096ca","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-e56e5b","namespace":"ai-tenant-e2e-shared-a-1096ca","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-1096ca/rate-test-model-1096ca"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-28T21:37:25Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"23bdcbdd-5260-4452-9dda-cedcc234475a","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-28T21:37:25Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"23bdcbdd-5260-4452-9dda-cedcc234475a","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-28T21:37:44Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f1fc3f6f-2298-4454-8c8e-dbab64448359","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.12:46670","PortSpecifier":{"PortValue":46670}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.70:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"f1fc3f6f-2298-4454-8c8e-dbab64448359","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-1096ca.apps.0d3a9b4b-eea4-4a9a-bf7c-8164c97d3cb1.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-28T21:37:44Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f1fc3f6f-2298-4454-8c8e-dbab64448359","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.12:46670","PortSpecifier":{"PortValue":46670}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.70:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785274664,"nanos":952751097},"http":{"id":"f1fc3f6f-2298-4454-8c8e-dbab64448359","method":"POST","headers":{":authority":"e2e-shared-a-1096ca.apps.0d3a9b4b-eea4-4a9a-bf7c-8164c97d3cb1.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T21:37:44Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"f1fc3f6f-2298-4454-8c8e-dbab64448359","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-28T21:37:44Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"f1fc3f6f-2298-4454-8c8e-dbab64448359","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"35152220-96db-4104-b373-3d2061e53190","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=6fa0e6ab-77c9-4860-a810-b1e01ec8d6f6"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/8164c97d3cb1"]}}
{"level":"debug","ts":"2026-07-28T21:37:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"f1fc3f6f-2298-4454-8c8e-dbab64448359","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/8164c97d3cb1"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=6fa0e6ab-77c9-4860-a810-b1e01ec8d6f6"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"35152220-96db-4104-b373-3d2061e53190","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"3b20ec24f664f2b9575e1b6b3300c2cc221dad6002ac18b24965d9c9ed6992d6"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.70:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-1096ca.apps.0d3a9b4b-eea4-4a9a-bf7c-8164c97d3cb1.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T21:37:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f1fc3f6f-2298-4454-8c8e-dbab64448359","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T21:37:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f1fc3f6f-2298-4454-8c8e-dbab64448359","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T21:37:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f1fc3f6f-2298-4454-8c8e-dbab64448359","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-1096ca/rate-test-model-1096ca\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-1096ca/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T21:37:44Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"f1fc3f6f-2298-4454-8c8e-dbab64448359","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"keyId","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-28T21:37:44Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f1fc3f6f-2298-4454-8c8e-dbab64448359","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-28T21:37:44Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f1fc3f6f-2298-4454-8c8e-dbab64448359","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-28T21:37:44Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f1fc3f6f-2298-4454-8c8e-dbab64448359","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-28T21:37:44Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f1fc3f6f-2298-4454-8c8e-dbab64448359","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-28T21:37:44Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1a44a7c3-9e30-4677-956f-4280e8df59b1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.12:56680","PortSpecifier":{"PortValue":56680}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.37:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"1a44a7c3-9e30-4677-956f-4280e8df59b1","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-2c3f70.apps.0d3a9b4b-eea4-4a9a-bf7c-8164c97d3cb1.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-28T21:37:44Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1a44a7c3-9e30-4677-956f-4280e8df59b1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.12:56680","PortSpecifier":{"PortValue":56680}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.37:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785274664,"nanos":990553029},"http":{"id":"1a44a7c3-9e30-4677-956f-4280e8df59b1","method":"POST","headers":{":authority":"e2e-shared-b-2c3f70.apps.0d3a9b4b-eea4-4a9a-bf7c-8164c97d3cb1.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T21:37:44Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"1a44a7c3-9e30-4677-956f-4280e8df59b1","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-28T21:37:44Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"1a44a7c3-9e30-4677-956f-4280e8df59b1","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"35152220-96db-4104-b373-3d2061e53190","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=6fa0e6ab-77c9-4860-a810-b1e01ec8d6f6"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/8164c97d3cb1"]}}
{"level":"debug","ts":"2026-07-28T21:37:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"1a44a7c3-9e30-4677-956f-4280e8df59b1","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/8164c97d3cb1"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=6fa0e6ab-77c9-4860-a810-b1e01ec8d6f6"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"35152220-96db-4104-b373-3d2061e53190","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"2699c6eca8d3ac82d1516377b9cafc6c758505ebc65479f362b20f1ec9613f20"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.37:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-2c3f70.apps.0d3a9b4b-eea4-4a9a-bf7c-8164c97d3cb1.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T21:37:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1a44a7c3-9e30-4677-956f-4280e8df59b1","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T21:37:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1a44a7c3-9e30-4677-956f-4280e8df59b1","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T21:37:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1a44a7c3-9e30-4677-956f-4280e8df59b1","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-2c3f70/rate-test-model-2c3f70\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-2c3f70/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T21:37:44Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"1a44a7c3-9e30-4677-956f-4280e8df59b1","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription_key","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-28T21:37:44Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1a44a7c3-9e30-4677-956f-4280e8df59b1","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-28T21:37:44Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1a44a7c3-9e30-4677-956f-4280e8df59b1","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-28T21:37:44Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1a44a7c3-9e30-4677-956f-4280e8df59b1","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-28T21:37:44Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1a44a7c3-9e30-4677-956f-4280e8df59b1","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-28T21:37:45Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"44ab3b30-5947-46b6-a883-900b5bac176e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.12:46686","PortSpecifier":{"PortValue":46686}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.70:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"44ab3b30-5947-46b6-a883-900b5bac176e","method":"POST","path":"/ai-tenant-e2e-shared-a-1096ca/rate-test-model-1096ca/v1/completions","host":"e2e-shared-a-1096ca.apps.0d3a9b4b-eea4-4a9a-bf7c-8164c97d3cb1.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-28T21:37:45Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"44ab3b30-5947-46b6-a883-900b5bac176e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.12:46686","PortSpecifier":{"PortValue":46686}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.70:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785274665,"nanos":23813585},"http":{"id":"44ab3b30-5947-46b6-a883-900b5bac176e","method":"POST","headers":{":authority":"e2e-shared-a-1096ca.apps.0d3a9b4b-eea4-4a9a-bf7c-8164c97d3cb1.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-1096ca/rate-test-model-1096ca/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T21:37:45Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"44ab3b30-5947-46b6-a883-900b5bac176e","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1PJvusoH4CbeqXPfQ_7SmpONgEdKJkIgtjELEClO0Gr9ezM8IK8f1wjR7IDmj"}
{"level":"debug","ts":"2026-07-28T21:37:45Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"44ab3b30-5947-46b6-a883-900b5bac176e","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-1096ca.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1PJvusoH4CbeqXPfQ_7SmpONgEdKJkIgtjELEClO0Gr9ezM8IK8f1wjR7IDmj\"}"}
{"level":"debug","ts":"2026-07-28T21:37:45Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"44ab3b30-5947-46b6-a883-900b5bac176e","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1096ca.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"b3e5b8bd-8df0-4818-8ae4-311923fa89b9","keyName":"e2e-rate-a-098b4a","subscription":"e2e-rate-iso-a-098b4a","tenant":"e2e-shared-a-1096ca","userId":"b3e5b8bd-8df0-4818-8ae4-311923fa89b9","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-28T21:37:45Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"44ab3b30-5947-46b6-a883-900b5bac176e","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-1096ca.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-1096ca/rate-test-model-1096ca\",\"requestedSubscription\":\"e2e-rate-iso-a-098b4a\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-28T21:37:45Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"44ab3b30-5947-46b6-a883-900b5bac176e","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1096ca.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-1096ca/models/facebook/opt-125m","name":"rate-test-model-1096ca","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-098b4a","namespace":"ai-tenant-e2e-shared-a-1096ca","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-1096ca/rate-test-model-1096ca"}}
{"level":"debug","ts":"2026-07-28T21:37:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"44ab3b30-5947-46b6-a883-900b5bac176e","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T21:37:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"44ab3b30-5947-46b6-a883-900b5bac176e","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T21:37:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"44ab3b30-5947-46b6-a883-900b5bac176e","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-1096ca/rate-test-model-1096ca\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-1096ca/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T21:37:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"44ab3b30-5947-46b6-a883-900b5bac176e","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T21:37:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"44ab3b30-5947-46b6-a883-900b5bac176e","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T21:37:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"44ab3b30-5947-46b6-a883-900b5bac176e","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-28T21:37:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"44ab3b30-5947-46b6-a883-900b5bac176e","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-098b4a"}
{"level":"debug","ts":"2026-07-28T21:37:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"44ab3b30-5947-46b6-a883-900b5bac176e","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-28T21:37:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"44ab3b30-5947-46b6-a883-900b5bac176e","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"b3e5b8bd-8df0-4818-8ae4-311923fa89b9","keyName":"e2e-rate-a-098b4a","selected_subscription":"e2e-rate-iso-a-098b4a","selected_subscription_key":"ai-tenant-e2e-shared-a-1096ca/e2e-rate-iso-a-098b4a@ai-tenant-e2e-shared-a-1096ca/rate-test-model-1096ca","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-1096ca/models/facebook/opt-125m","name":"rate-test-model-1096ca","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-098b4a","namespace":"ai-tenant-e2e-shared-a-1096ca","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-1096ca/rate-test-model-1096ca"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-28T21:37:45Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"44ab3b30-5947-46b6-a883-900b5bac176e","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-28T21:37:45Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"44ab3b30-5947-46b6-a883-900b5bac176e","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-28T21:37:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"80eb73f2-e26d-4ac0-829d-b8170bb19d14","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.12:46698","PortSpecifier":{"PortValue":46698}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.70:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"80eb73f2-e26d-4ac0-829d-b8170bb19d14","method":"POST","path":"/ai-tenant-e2e-shared-a-1096ca/rate-test-model-1096ca/v1/completions","host":"e2e-shared-a-1096ca.apps.0d3a9b4b-eea4-4a9a-bf7c-8164c97d3cb1.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-28T21:37:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"80eb73f2-e26d-4ac0-829d-b8170bb19d14","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.12:46698","PortSpecifier":{"PortValue":46698}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.70:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785274666,"nanos":61835383},"http":{"id":"80eb73f2-e26d-4ac0-829d-b8170bb19d14","method":"POST","headers":{":authority":"e2e-shared-a-1096ca.apps.0d3a9b4b-eea4-4a9a-bf7c-8164c97d3cb1.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-1096ca/rate-test-model-1096ca/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T21:37:46Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"80eb73f2-e26d-4ac0-829d-b8170bb19d14","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1PJvusoH4CbeqXPfQ_7SmpONgEdKJkIgtjELEClO0Gr9ezM8IK8f1wjR7IDmj"}
{"level":"debug","ts":"2026-07-28T21:37:46Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"80eb73f2-e26d-4ac0-829d-b8170bb19d14","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-1096ca.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1PJvusoH4CbeqXPfQ_7SmpONgEdKJkIgtjELEClO0Gr9ezM8IK8f1wjR7IDmj\"}"}
{"level":"debug","ts":"2026-07-28T21:37:46Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"80eb73f2-e26d-4ac0-829d-b8170bb19d14","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1096ca.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"b3e5b8bd-8df0-4818-8ae4-311923fa89b9","keyName":"e2e-rate-a-098b4a","subscription":"e2e-rate-iso-a-098b4a","tenant":"e2e-shared-a-1096ca","userId":"b3e5b8bd-8df0-4818-8ae4-311923fa89b9","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-28T21:37:46Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"80eb73f2-e26d-4ac0-829d-b8170bb19d14","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-1096ca.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-1096ca/rate-test-model-1096ca\",\"requestedSubscription\":\"e2e-rate-iso-a-098b4a\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-28T21:37:46Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"80eb73f2-e26d-4ac0-829d-b8170bb19d14","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1096ca.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-1096ca/models/facebook/opt-125m","name":"rate-test-model-1096ca","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-098b4a","namespace":"ai-tenant-e2e-shared-a-1096ca","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-1096ca/rate-test-model-1096ca"}}
{"level":"debug","ts":"2026-07-28T21:37:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"80eb73f2-e26d-4ac0-829d-b8170bb19d14","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T21:37:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"80eb73f2-e26d-4ac0-829d-b8170bb19d14","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T21:37:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"80eb73f2-e26d-4ac0-829d-b8170bb19d14","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T21:37:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"80eb73f2-e26d-4ac0-829d-b8170bb19d14","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-1096ca/rate-test-model-1096ca\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-1096ca/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T21:37:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"80eb73f2-e26d-4ac0-829d-b8170bb19d14","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T21:37:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"80eb73f2-e26d-4ac0-829d-b8170bb19d14","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-28T21:37:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"80eb73f2-e26d-4ac0-829d-b8170bb19d14","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-098b4a"}
{"level":"debug","ts":"2026-07-28T21:37:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"80eb73f2-e26d-4ac0-829d-b8170bb19d14","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-28T21:37:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"80eb73f2-e26d-4ac0-829d-b8170bb19d14","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"b3e5b8bd-8df0-4818-8ae4-311923fa89b9","keyName":"e2e-rate-a-098b4a","selected_subscription":"e2e-rate-iso-a-098b4a","selected_subscription_key":"ai-tenant-e2e-shared-a-1096ca/e2e-rate-iso-a-098b4a@ai-tenant-e2e-shared-a-1096ca/rate-test-model-1096ca","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-1096ca/models/facebook/opt-125m","name":"rate-test-model-1096ca","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-098b4a","namespace":"ai-tenant-e2e-shared-a-1096ca","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-1096ca/rate-test-model-1096ca"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-28T21:37:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"80eb73f2-e26d-4ac0-829d-b8170bb19d14","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-28T21:37:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"80eb73f2-e26d-4ac0-829d-b8170bb19d14","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-28T21:37:47Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"38a604cc-f0ca-46e7-9de4-66baf4313f6e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.12:46706","PortSpecifier":{"PortValue":46706}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.70:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"38a604cc-f0ca-46e7-9de4-66baf4313f6e","method":"POST","path":"/ai-tenant-e2e-shared-a-1096ca/rate-test-model-1096ca/v1/completions","host":"e2e-shared-a-1096ca.apps.0d3a9b4b-eea4-4a9a-bf7c-8164c97d3cb1.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-28T21:37:47Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"38a604cc-f0ca-46e7-9de4-66baf4313f6e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.12:46706","PortSpecifier":{"PortValue":46706}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.70:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785274667,"nanos":98496153},"http":{"id":"38a604cc-f0ca-46e7-9de4-66baf4313f6e","method":"POST","headers":{":authority":"e2e-shared-a-1096ca.apps.0d3a9b4b-eea4-4a9a-bf7c-8164c97d3cb1.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-1096ca/rate-test-model-1096ca/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T21:37:47Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"38a604cc-f0ca-46e7-9de4-66baf4313f6e","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1PJvusoH4CbeqXPfQ_7SmpONgEdKJkIgtjELEClO0Gr9ezM8IK8f1wjR7IDmj"}
{"level":"debug","ts":"2026-07-28T21:37:47Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"38a604cc-f0ca-46e7-9de4-66baf4313f6e","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-1096ca.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1PJvusoH4CbeqXPfQ_7SmpONgEdKJkIgtjELEClO0Gr9ezM8IK8f1wjR7IDmj\"}"}
{"level":"debug","ts":"2026-07-28T21:37:47Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"38a604cc-f0ca-46e7-9de4-66baf4313f6e","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1096ca.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"b3e5b8bd-8df0-4818-8ae4-311923fa89b9","keyName":"e2e-rate-a-098b4a","subscription":"e2e-rate-iso-a-098b4a","tenant":"e2e-shared-a-1096ca","userId":"b3e5b8bd-8df0-4818-8ae4-311923fa89b9","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-28T21:37:47Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"38a604cc-f0ca-46e7-9de4-66baf4313f6e","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-1096ca.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-1096ca/rate-test-model-1096ca\",\"requestedSubscription\":\"e2e-rate-iso-a-098b4a\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-28T21:37:47Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"38a604cc-f0ca-46e7-9de4-66baf4313f6e","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1096ca.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-1096ca/models/facebook/opt-125m","name":"rate-test-model-1096ca","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-098b4a","namespace":"ai-tenant-e2e-shared-a-1096ca","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-1096ca/rate-test-model-1096ca"}}
{"level":"debug","ts":"2026-07-28T21:37:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"38a604cc-f0ca-46e7-9de4-66baf4313f6e","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T21:37:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"38a604cc-f0ca-46e7-9de4-66baf4313f6e","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T21:37:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"38a604cc-f0ca-46e7-9de4-66baf4313f6e","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T21:37:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"38a604cc-f0ca-46e7-9de4-66baf4313f6e","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-1096ca/rate-test-model-1096ca\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-1096ca/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T21:37:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"38a604cc-f0ca-46e7-9de4-66baf4313f6e","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T21:37:47Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"38a604cc-f0ca-46e7-9de4-66baf4313f6e","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-28T21:37:47Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"38a604cc-f0ca-46e7-9de4-66baf4313f6e","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-098b4a"}
{"level":"debug","ts":"2026-07-28T21:37:47Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"38a604cc-f0ca-46e7-9de4-66baf4313f6e","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-28T21:37:47Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"38a604cc-f0ca-46e7-9de4-66baf4313f6e","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"b3e5b8bd-8df0-4818-8ae4-311923fa89b9","keyName":"e2e-rate-a-098b4a","selected_subscription":"e2e-rate-iso-a-098b4a","selected_subscription_key":"ai-tenant-e2e-shared-a-1096ca/e2e-rate-iso-a-098b4a@ai-tenant-e2e-shared-a-1096ca/rate-test-model-1096ca","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-1096ca/models/facebook/opt-125m","name":"rate-test-model-1096ca","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-098b4a","namespace":"ai-tenant-e2e-shared-a-1096ca","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-1096ca/rate-test-model-1096ca"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-28T21:37:47Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"38a604cc-f0ca-46e7-9de4-66baf4313f6e","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-28T21:37:47Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"38a604cc-f0ca-46e7-9de4-66baf4313f6e","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-28T21:37:48Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d0bc0f8e-b905-4443-abdf-fe8ee673b2bc","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.12:46716","PortSpecifier":{"PortValue":46716}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.70:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"d0bc0f8e-b905-4443-abdf-fe8ee673b2bc","method":"POST","path":"/ai-tenant-e2e-shared-a-1096ca/rate-test-model-1096ca/v1/completions","host":"e2e-shared-a-1096ca.apps.0d3a9b4b-eea4-4a9a-bf7c-8164c97d3cb1.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-28T21:37:48Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d0bc0f8e-b905-4443-abdf-fe8ee673b2bc","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.12:46716","PortSpecifier":{"PortValue":46716}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.70:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785274668,"nanos":130988656},"http":{"id":"d0bc0f8e-b905-4443-abdf-fe8ee673b2bc","method":"POST","headers":{":authority":"e2e-shared-a-1096ca.apps.0d3a9b4b-eea4-4a9a-bf7c-8164c97d3cb1.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-1096ca/rate-test-model-1096ca/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T21:37:48Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"d0bc0f8e-b905-4443-abdf-fe8ee673b2bc","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1PJvusoH4CbeqXPfQ_7SmpONgEdKJkIgtjELEClO0Gr9ezM8IK8f1wjR7IDmj"}
{"level":"debug","ts":"2026-07-28T21:37:48Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"d0bc0f8e-b905-4443-abdf-fe8ee673b2bc","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-1096ca.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1PJvusoH4CbeqXPfQ_7SmpONgEdKJkIgtjELEClO0Gr9ezM8IK8f1wjR7IDmj\"}"}
{"level":"debug","ts":"2026-07-28T21:37:48Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"d0bc0f8e-b905-4443-abdf-fe8ee673b2bc","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1096ca.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"b3e5b8bd-8df0-4818-8ae4-311923fa89b9","keyName":"e2e-rate-a-098b4a","subscription":"e2e-rate-iso-a-098b4a","tenant":"e2e-shared-a-1096ca","userId":"b3e5b8bd-8df0-4818-8ae4-311923fa89b9","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-28T21:37:48Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"d0bc0f8e-b905-4443-abdf-fe8ee673b2bc","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-1096ca.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-1096ca/rate-test-model-1096ca\",\"requestedSubscription\":\"e2e-rate-iso-a-098b4a\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-28T21:37:48Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"d0bc0f8e-b905-4443-abdf-fe8ee673b2bc","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1096ca.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-1096ca/models/facebook/opt-125m","name":"rate-test-model-1096ca","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-098b4a","namespace":"ai-tenant-e2e-shared-a-1096ca","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-1096ca/rate-test-model-1096ca"}}
{"level":"debug","ts":"2026-07-28T21:37:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"d0bc0f8e-b905-4443-abdf-fe8ee673b2bc","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T21:37:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d0bc0f8e-b905-4443-abdf-fe8ee673b2bc","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T21:37:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d0bc0f8e-b905-4443-abdf-fe8ee673b2bc","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T21:37:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d0bc0f8e-b905-4443-abdf-fe8ee673b2bc","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T21:37:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d0bc0f8e-b905-4443-abdf-fe8ee673b2bc","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-1096ca/rate-test-model-1096ca\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-1096ca/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T21:37:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d0bc0f8e-b905-4443-abdf-fe8ee673b2bc","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-28T21:37:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d0bc0f8e-b905-4443-abdf-fe8ee673b2bc","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-28T21:37:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d0bc0f8e-b905-4443-abdf-fe8ee673b2bc","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-098b4a"}
{"level":"debug","ts":"2026-07-28T21:37:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d0bc0f8e-b905-4443-abdf-fe8ee673b2bc","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"b3e5b8bd-8df0-4818-8ae4-311923fa89b9","keyName":"e2e-rate-a-098b4a","selected_subscription":"e2e-rate-iso-a-098b4a","selected_subscription_key":"ai-tenant-e2e-shared-a-1096ca/e2e-rate-iso-a-098b4a@ai-tenant-e2e-shared-a-1096ca/rate-test-model-1096ca","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-1096ca/models/facebook/opt-125m","name":"rate-test-model-1096ca","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-098b4a","namespace":"ai-tenant-e2e-shared-a-1096ca","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-1096ca/rate-test-model-1096ca"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-28T21:37:48Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d0bc0f8e-b905-4443-abdf-fe8ee673b2bc","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-28T21:37:48Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d0bc0f8e-b905-4443-abdf-fe8ee673b2bc","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-28T21:37:49Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f07ab11f-bd91-4bae-b00e-35acf1622b1a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.12:60720","PortSpecifier":{"PortValue":60720}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.70:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"f07ab11f-bd91-4bae-b00e-35acf1622b1a","method":"POST","path":"/ai-tenant-e2e-shared-a-1096ca/rate-test-model-1096ca/v1/completions","host":"e2e-shared-a-1096ca.apps.0d3a9b4b-eea4-4a9a-bf7c-8164c97d3cb1.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-28T21:37:49Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f07ab11f-bd91-4bae-b00e-35acf1622b1a","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.12:60720","PortSpecifier":{"PortValue":60720}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.70:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785274669,"nanos":165460336},"http":{"id":"f07ab11f-bd91-4bae-b00e-35acf1622b1a","method":"POST","headers":{":authority":"e2e-shared-a-1096ca.apps.0d3a9b4b-eea4-4a9a-bf7c-8164c97d3cb1.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-1096ca/rate-test-model-1096ca/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T21:37:49Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"f07ab11f-bd91-4bae-b00e-35acf1622b1a","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1PJvusoH4CbeqXPfQ_7SmpONgEdKJkIgtjELEClO0Gr9ezM8IK8f1wjR7IDmj"}
{"level":"debug","ts":"2026-07-28T21:37:49Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"f07ab11f-bd91-4bae-b00e-35acf1622b1a","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-1096ca.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1PJvusoH4CbeqXPfQ_7SmpONgEdKJkIgtjELEClO0Gr9ezM8IK8f1wjR7IDmj\"}"}
{"level":"debug","ts":"2026-07-28T21:37:49Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"f07ab11f-bd91-4bae-b00e-35acf1622b1a","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1096ca.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"b3e5b8bd-8df0-4818-8ae4-311923fa89b9","keyName":"e2e-rate-a-098b4a","subscription":"e2e-rate-iso-a-098b4a","tenant":"e2e-shared-a-1096ca","userId":"b3e5b8bd-8df0-4818-8ae4-311923fa89b9","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-28T21:37:49Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"f07ab11f-bd91-4bae-b00e-35acf1622b1a","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-1096ca.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-1096ca/rate-test-model-1096ca\",\"requestedSubscription\":\"e2e-rate-iso-a-098b4a\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-28T21:37:49Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"f07ab11f-bd91-4bae-b00e-35acf1622b1a","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1096ca.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-1096ca/models/facebook/opt-125m","name":"rate-test-model-1096ca","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-098b4a","namespace":"ai-tenant-e2e-shared-a-1096ca","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-1096ca/rate-test-model-1096ca"}}
{"level":"debug","ts":"2026-07-28T21:37:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"f07ab11f-bd91-4bae-b00e-35acf1622b1a","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T21:37:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f07ab11f-bd91-4bae-b00e-35acf1622b1a","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T21:37:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f07ab11f-bd91-4bae-b00e-35acf1622b1a","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T21:37:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f07ab11f-bd91-4bae-b00e-35acf1622b1a","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T21:37:49Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f07ab11f-bd91-4bae-b00e-35acf1622b1a","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-1096ca/rate-test-model-1096ca\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-1096ca/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T21:37:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f07ab11f-bd91-4bae-b00e-35acf1622b1a","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-28T21:37:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f07ab11f-bd91-4bae-b00e-35acf1622b1a","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-098b4a"}
{"level":"debug","ts":"2026-07-28T21:37:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f07ab11f-bd91-4bae-b00e-35acf1622b1a","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-28T21:37:49Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f07ab11f-bd91-4bae-b00e-35acf1622b1a","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"b3e5b8bd-8df0-4818-8ae4-311923fa89b9","keyName":"e2e-rate-a-098b4a","selected_subscription":"e2e-rate-iso-a-098b4a","selected_subscription_key":"ai-tenant-e2e-shared-a-1096ca/e2e-rate-iso-a-098b4a@ai-tenant-e2e-shared-a-1096ca/rate-test-model-1096ca","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-1096ca/models/facebook/opt-125m","name":"rate-test-model-1096ca","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-098b4a","namespace":"ai-tenant-e2e-shared-a-1096ca","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-1096ca/rate-test-model-1096ca"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-28T21:37:49Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f07ab11f-bd91-4bae-b00e-35acf1622b1a","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-28T21:37:49Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f07ab11f-bd91-4bae-b00e-35acf1622b1a","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-28T21:37:50Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5cb0bc75-60fa-4b64-aea3-1dfdc91699b5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.12:60732","PortSpecifier":{"PortValue":60732}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.70:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"5cb0bc75-60fa-4b64-aea3-1dfdc91699b5","method":"POST","path":"/ai-tenant-e2e-shared-a-1096ca/rate-test-model-1096ca/v1/completions","host":"e2e-shared-a-1096ca.apps.0d3a9b4b-eea4-4a9a-bf7c-8164c97d3cb1.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-28T21:37:50Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5cb0bc75-60fa-4b64-aea3-1dfdc91699b5","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.12:60732","PortSpecifier":{"PortValue":60732}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.70:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785274670,"nanos":199664217},"http":{"id":"5cb0bc75-60fa-4b64-aea3-1dfdc91699b5","method":"POST","headers":{":authority":"e2e-shared-a-1096ca.apps.0d3a9b4b-eea4-4a9a-bf7c-8164c97d3cb1.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-1096ca/rate-test-model-1096ca/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T21:37:50Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"5cb0bc75-60fa-4b64-aea3-1dfdc91699b5","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1PJvusoH4CbeqXPfQ_7SmpONgEdKJkIgtjELEClO0Gr9ezM8IK8f1wjR7IDmj"}
{"level":"debug","ts":"2026-07-28T21:37:50Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"5cb0bc75-60fa-4b64-aea3-1dfdc91699b5","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-1096ca.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1PJvusoH4CbeqXPfQ_7SmpONgEdKJkIgtjELEClO0Gr9ezM8IK8f1wjR7IDmj\"}"}
{"level":"debug","ts":"2026-07-28T21:37:50Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"5cb0bc75-60fa-4b64-aea3-1dfdc91699b5","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1096ca.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"b3e5b8bd-8df0-4818-8ae4-311923fa89b9","keyName":"e2e-rate-a-098b4a","subscription":"e2e-rate-iso-a-098b4a","tenant":"e2e-shared-a-1096ca","userId":"b3e5b8bd-8df0-4818-8ae4-311923fa89b9","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-28T21:37:50Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"5cb0bc75-60fa-4b64-aea3-1dfdc91699b5","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-1096ca.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-1096ca/rate-test-model-1096ca\",\"requestedSubscription\":\"e2e-rate-iso-a-098b4a\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-28T21:37:50Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"5cb0bc75-60fa-4b64-aea3-1dfdc91699b5","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1096ca.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-1096ca/models/facebook/opt-125m","name":"rate-test-model-1096ca","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-098b4a","namespace":"ai-tenant-e2e-shared-a-1096ca","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-1096ca/rate-test-model-1096ca"}}
{"level":"debug","ts":"2026-07-28T21:37:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"5cb0bc75-60fa-4b64-aea3-1dfdc91699b5","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T21:37:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5cb0bc75-60fa-4b64-aea3-1dfdc91699b5","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T21:37:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5cb0bc75-60fa-4b64-aea3-1dfdc91699b5","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T21:37:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5cb0bc75-60fa-4b64-aea3-1dfdc91699b5","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-1096ca/rate-test-model-1096ca\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-1096ca/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T21:37:50Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5cb0bc75-60fa-4b64-aea3-1dfdc91699b5","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T21:37:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5cb0bc75-60fa-4b64-aea3-1dfdc91699b5","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-098b4a"}
{"level":"debug","ts":"2026-07-28T21:37:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5cb0bc75-60fa-4b64-aea3-1dfdc91699b5","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-28T21:37:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5cb0bc75-60fa-4b64-aea3-1dfdc91699b5","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-28T21:37:50Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5cb0bc75-60fa-4b64-aea3-1dfdc91699b5","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"b3e5b8bd-8df0-4818-8ae4-311923fa89b9","keyName":"e2e-rate-a-098b4a","selected_subscription":"e2e-rate-iso-a-098b4a","selected_subscription_key":"ai-tenant-e2e-shared-a-1096ca/e2e-rate-iso-a-098b4a@ai-tenant-e2e-shared-a-1096ca/rate-test-model-1096ca","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-1096ca/models/facebook/opt-125m","name":"rate-test-model-1096ca","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-098b4a","namespace":"ai-tenant-e2e-shared-a-1096ca","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-1096ca/rate-test-model-1096ca"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-28T21:37:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5cb0bc75-60fa-4b64-aea3-1dfdc91699b5","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-28T21:37:50Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5cb0bc75-60fa-4b64-aea3-1dfdc91699b5","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-28T21:37:51Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c35ae339-ba50-4420-bbbb-d1cec2111b30","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.12:60748","PortSpecifier":{"PortValue":60748}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.70:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"c35ae339-ba50-4420-bbbb-d1cec2111b30","method":"POST","path":"/ai-tenant-e2e-shared-a-1096ca/rate-test-model-1096ca/v1/completions","host":"e2e-shared-a-1096ca.apps.0d3a9b4b-eea4-4a9a-bf7c-8164c97d3cb1.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-28T21:37:51Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"c35ae339-ba50-4420-bbbb-d1cec2111b30","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.12:60748","PortSpecifier":{"PortValue":60748}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.70:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785274671,"nanos":232639085},"http":{"id":"c35ae339-ba50-4420-bbbb-d1cec2111b30","method":"POST","headers":{":authority":"e2e-shared-a-1096ca.apps.0d3a9b4b-eea4-4a9a-bf7c-8164c97d3cb1.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-1096ca/rate-test-model-1096ca/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T21:37:51Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"c35ae339-ba50-4420-bbbb-d1cec2111b30","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1PJvusoH4CbeqXPfQ_7SmpONgEdKJkIgtjELEClO0Gr9ezM8IK8f1wjR7IDmj"}
{"level":"debug","ts":"2026-07-28T21:37:51Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"c35ae339-ba50-4420-bbbb-d1cec2111b30","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-1096ca.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1PJvusoH4CbeqXPfQ_7SmpONgEdKJkIgtjELEClO0Gr9ezM8IK8f1wjR7IDmj\"}"}
{"level":"debug","ts":"2026-07-28T21:37:51Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"c35ae339-ba50-4420-bbbb-d1cec2111b30","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1096ca.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"b3e5b8bd-8df0-4818-8ae4-311923fa89b9","keyName":"e2e-rate-a-098b4a","subscription":"e2e-rate-iso-a-098b4a","tenant":"e2e-shared-a-1096ca","userId":"b3e5b8bd-8df0-4818-8ae4-311923fa89b9","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-28T21:37:51Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"c35ae339-ba50-4420-bbbb-d1cec2111b30","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-1096ca.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-1096ca/rate-test-model-1096ca\",\"requestedSubscription\":\"e2e-rate-iso-a-098b4a\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-28T21:37:51Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"c35ae339-ba50-4420-bbbb-d1cec2111b30","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1096ca.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-1096ca/models/facebook/opt-125m","name":"rate-test-model-1096ca","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-098b4a","namespace":"ai-tenant-e2e-shared-a-1096ca","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-1096ca/rate-test-model-1096ca"}}
{"level":"debug","ts":"2026-07-28T21:37:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"c35ae339-ba50-4420-bbbb-d1cec2111b30","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T21:37:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c35ae339-ba50-4420-bbbb-d1cec2111b30","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T21:37:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c35ae339-ba50-4420-bbbb-d1cec2111b30","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T21:37:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c35ae339-ba50-4420-bbbb-d1cec2111b30","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T21:37:51Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"c35ae339-ba50-4420-bbbb-d1cec2111b30","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-1096ca/rate-test-model-1096ca\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-1096ca/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T21:37:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c35ae339-ba50-4420-bbbb-d1cec2111b30","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-28T21:37:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c35ae339-ba50-4420-bbbb-d1cec2111b30","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-098b4a"}
{"level":"debug","ts":"2026-07-28T21:37:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c35ae339-ba50-4420-bbbb-d1cec2111b30","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-28T21:37:51Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"c35ae339-ba50-4420-bbbb-d1cec2111b30","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"b3e5b8bd-8df0-4818-8ae4-311923fa89b9","keyName":"e2e-rate-a-098b4a","selected_subscription":"e2e-rate-iso-a-098b4a","selected_subscription_key":"ai-tenant-e2e-shared-a-1096ca/e2e-rate-iso-a-098b4a@ai-tenant-e2e-shared-a-1096ca/rate-test-model-1096ca","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-1096ca/models/facebook/opt-125m","name":"rate-test-model-1096ca","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-098b4a","namespace":"ai-tenant-e2e-shared-a-1096ca","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-1096ca/rate-test-model-1096ca"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-28T21:37:51Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c35ae339-ba50-4420-bbbb-d1cec2111b30","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-28T21:37:51Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"c35ae339-ba50-4420-bbbb-d1cec2111b30","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-28T21:37:52Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"61d35dd8-af28-41fe-a623-b98a11e3da47","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.12:60762","PortSpecifier":{"PortValue":60762}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.70:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"61d35dd8-af28-41fe-a623-b98a11e3da47","method":"POST","path":"/ai-tenant-e2e-shared-a-1096ca/rate-test-model-1096ca/v1/completions","host":"e2e-shared-a-1096ca.apps.0d3a9b4b-eea4-4a9a-bf7c-8164c97d3cb1.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-28T21:37:52Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"61d35dd8-af28-41fe-a623-b98a11e3da47","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.12:60762","PortSpecifier":{"PortValue":60762}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.70:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785274672,"nanos":270008626},"http":{"id":"61d35dd8-af28-41fe-a623-b98a11e3da47","method":"POST","headers":{":authority":"e2e-shared-a-1096ca.apps.0d3a9b4b-eea4-4a9a-bf7c-8164c97d3cb1.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-1096ca/rate-test-model-1096ca/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T21:37:52Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"61d35dd8-af28-41fe-a623-b98a11e3da47","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1PJvusoH4CbeqXPfQ_7SmpONgEdKJkIgtjELEClO0Gr9ezM8IK8f1wjR7IDmj"}
{"level":"debug","ts":"2026-07-28T21:37:52Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"61d35dd8-af28-41fe-a623-b98a11e3da47","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-1096ca.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1PJvusoH4CbeqXPfQ_7SmpONgEdKJkIgtjELEClO0Gr9ezM8IK8f1wjR7IDmj\"}"}
{"level":"debug","ts":"2026-07-28T21:37:52Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"61d35dd8-af28-41fe-a623-b98a11e3da47","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1096ca.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"b3e5b8bd-8df0-4818-8ae4-311923fa89b9","keyName":"e2e-rate-a-098b4a","subscription":"e2e-rate-iso-a-098b4a","tenant":"e2e-shared-a-1096ca","userId":"b3e5b8bd-8df0-4818-8ae4-311923fa89b9","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-28T21:37:52Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"61d35dd8-af28-41fe-a623-b98a11e3da47","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-1096ca.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-1096ca/rate-test-model-1096ca\",\"requestedSubscription\":\"e2e-rate-iso-a-098b4a\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-28T21:37:52Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"61d35dd8-af28-41fe-a623-b98a11e3da47","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-1096ca.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-1096ca/models/facebook/opt-125m","name":"rate-test-model-1096ca","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-098b4a","namespace":"ai-tenant-e2e-shared-a-1096ca","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-1096ca/rate-test-model-1096ca"}}
{"level":"debug","ts":"2026-07-28T21:37:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"61d35dd8-af28-41fe-a623-b98a11e3da47","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T21:37:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"61d35dd8-af28-41fe-a623-b98a11e3da47","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T21:37:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"61d35dd8-af28-41fe-a623-b98a11e3da47","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T21:37:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"61d35dd8-af28-41fe-a623-b98a11e3da47","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T21:37:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"61d35dd8-af28-41fe-a623-b98a11e3da47","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-1096ca/rate-test-model-1096ca\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-a-1096ca/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T21:37:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"61d35dd8-af28-41fe-a623-b98a11e3da47","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-098b4a"}
{"level":"debug","ts":"2026-07-28T21:37:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"61d35dd8-af28-41fe-a623-b98a11e3da47","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-28T21:37:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"61d35dd8-af28-41fe-a623-b98a11e3da47","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-28T21:37:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"61d35dd8-af28-41fe-a623-b98a11e3da47","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"b3e5b8bd-8df0-4818-8ae4-311923fa89b9","keyName":"e2e-rate-a-098b4a","selected_subscription":"e2e-rate-iso-a-098b4a","selected_subscription_key":"ai-tenant-e2e-shared-a-1096ca/e2e-rate-iso-a-098b4a@ai-tenant-e2e-shared-a-1096ca/rate-test-model-1096ca","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-a-1096ca/models/facebook/opt-125m","name":"rate-test-model-1096ca","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-098b4a","namespace":"ai-tenant-e2e-shared-a-1096ca","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-a-1096ca/rate-test-model-1096ca"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-28T21:37:52Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"61d35dd8-af28-41fe-a623-b98a11e3da47","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-28T21:37:52Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"61d35dd8-af28-41fe-a623-b98a11e3da47","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-28T21:37:52Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ffe368cc-940b-4fd2-afa5-64453a638be4","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.12:58622","PortSpecifier":{"PortValue":58622}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.37:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"ffe368cc-940b-4fd2-afa5-64453a638be4","method":"POST","path":"/ai-tenant-e2e-shared-b-2c3f70/rate-test-model-2c3f70/v1/completions","host":"e2e-shared-b-2c3f70.apps.0d3a9b4b-eea4-4a9a-bf7c-8164c97d3cb1.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-28T21:37:52Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ffe368cc-940b-4fd2-afa5-64453a638be4","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.12:58622","PortSpecifier":{"PortValue":58622}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.37:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785274672,"nanos":302249907},"http":{"id":"ffe368cc-940b-4fd2-afa5-64453a638be4","method":"POST","headers":{":authority":"e2e-shared-b-2c3f70.apps.0d3a9b4b-eea4-4a9a-bf7c-8164c97d3cb1.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-b-2c3f70/rate-test-model-2c3f70/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T21:37:52Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"ffe368cc-940b-4fd2-afa5-64453a638be4","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1RjdDaymxEo29o8ro_nD6IvWBUxrtkKfbIHqHDhC3cCbWRvd1LGfpiW0QAzGI"}
{"level":"debug","ts":"2026-07-28T21:37:52Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"ffe368cc-940b-4fd2-afa5-64453a638be4","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-b-2c3f70.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1RjdDaymxEo29o8ro_nD6IvWBUxrtkKfbIHqHDhC3cCbWRvd1LGfpiW0QAzGI\"}"}
{"level":"debug","ts":"2026-07-28T21:37:52Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"ffe368cc-940b-4fd2-afa5-64453a638be4","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-2c3f70.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"5c5b5763-3a10-4e06-8327-daca2367fe17","keyName":"e2e-rate-b-098b4a","subscription":"e2e-rate-iso-b-098b4a","tenant":"e2e-shared-b-2c3f70","userId":"5c5b5763-3a10-4e06-8327-daca2367fe17","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-28T21:37:52Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"ffe368cc-940b-4fd2-afa5-64453a638be4","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-b-2c3f70.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-b-2c3f70/rate-test-model-2c3f70\",\"requestedSubscription\":\"e2e-rate-iso-b-098b4a\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-28T21:37:52Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"ffe368cc-940b-4fd2-afa5-64453a638be4","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-2c3f70.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-b-2c3f70/models/facebook/opt-125m","name":"rate-test-model-2c3f70","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-098b4a","namespace":"ai-tenant-e2e-shared-b-2c3f70","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-b-2c3f70/rate-test-model-2c3f70"}}
{"level":"debug","ts":"2026-07-28T21:37:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"ffe368cc-940b-4fd2-afa5-64453a638be4","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T21:37:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ffe368cc-940b-4fd2-afa5-64453a638be4","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T21:37:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ffe368cc-940b-4fd2-afa5-64453a638be4","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T21:37:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ffe368cc-940b-4fd2-afa5-64453a638be4","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T21:37:52Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ffe368cc-940b-4fd2-afa5-64453a638be4","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-2c3f70/rate-test-model-2c3f70\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-shared-b-2c3f70/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T21:37:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ffe368cc-940b-4fd2-afa5-64453a638be4","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-28T21:37:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ffe368cc-940b-4fd2-afa5-64453a638be4","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-b-098b4a"}
{"level":"debug","ts":"2026-07-28T21:37:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ffe368cc-940b-4fd2-afa5-64453a638be4","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-28T21:37:52Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ffe368cc-940b-4fd2-afa5-64453a638be4","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"5c5b5763-3a10-4e06-8327-daca2367fe17","keyName":"e2e-rate-b-098b4a","selected_subscription":"e2e-rate-iso-b-098b4a","selected_subscription_key":"ai-tenant-e2e-shared-b-2c3f70/e2e-rate-iso-b-098b4a@ai-tenant-e2e-shared-b-2c3f70/rate-test-model-2c3f70","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-shared-b-2c3f70/models/facebook/opt-125m","name":"rate-test-model-2c3f70","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-098b4a","namespace":"ai-tenant-e2e-shared-b-2c3f70","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-shared-b-2c3f70/rate-test-model-2c3f70"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-28T21:37:52Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ffe368cc-940b-4fd2-afa5-64453a638be4","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-28T21:37:52Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ffe368cc-940b-4fd2-afa5-64453a638be4","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-28T21:37:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/20b1531c2d91304f9ded28c4e654b3038427c953e6c7b56e09d234609b224fd4"}
{"level":"info","ts":"2026-07-28T21:37:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/1ebf5f01879e47101126d9de3e132bca3594956aa45a9a231d2d97b3b8776cb4"}
{"level":"info","ts":"2026-07-28T21:37:57Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/0a8a7a681ddd62ae297fa132dab0c30373c89aa550bda497bb9816beb5508dc6"}
{"level":"info","ts":"2026-07-28T21:37:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/2699c6eca8d3ac82d1516377b9cafc6c758505ebc65479f362b20f1ec9613f20"}
{"level":"info","ts":"2026-07-28T21:37:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/bd7948d89d6cbdcf8ab5589a4bb99aa82507b2095c7149ca643df4a8895d512d"}
{"level":"info","ts":"2026-07-28T21:37:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/e60dc621f521f5431ed32a7dd14493341720d51087ba5874b7fcf73e4d457926"}
{"level":"info","ts":"2026-07-28T21:37:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/b5e5f8fcaecc23183bd14c551170d3f3cdb41d03b42f5a6807585769fdf7fa0e"}
{"level":"info","ts":"2026-07-28T21:37:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/6809f125f1458ab3a374185fc8fcb97ab74a44ecd2b2e74f8dcaefb7980de0fa"}
{"level":"info","ts":"2026-07-28T21:37:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/3cee34a85805501a1ae249bfedc8fa9f178b093394c4cd2a367ee5792c6304cc"}
{"level":"info","ts":"2026-07-28T21:37:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/35d4f217ec1cec9352becf6f7f8d636e0ed8841be0b9daddef2b10bfa4260f4a"}
{"level":"info","ts":"2026-07-28T21:37:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/cdc17b598113fdab333c0760172d8b3d62dff49e17c637b2052393695507941c"}
{"level":"info","ts":"2026-07-28T21:37:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/735c377d188f4dcd4cbc2227f8a00d4514482ad50cc013d4bb42cf9520b31171"}
{"level":"info","ts":"2026-07-28T21:37:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/4dad495fd046f454adc596c183e61718617fd2f81ebf5bf5ff1602cd6ae84b2e"}
{"level":"info","ts":"2026-07-28T21:37:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/95312f273beb4d8dc991c97749002c9b3141188552fd4239f3c96fef83bb08c6"}
{"level":"info","ts":"2026-07-28T21:37:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/b9b4e481a04630537bb8516e88500930abf4e1625133377f374a9c08c840f81e"}
{"level":"info","ts":"2026-07-28T21:37:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/c4464c54d6ce314f52c2ec8161e92d716b452abc628db9663c0ae5a6ae17a8b1"}
{"level":"info","ts":"2026-07-28T21:37:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/677cb76e80e30fedb2632ebce8dba3b16967581ac094752b46d8ec5fa8d84799"}
{"level":"info","ts":"2026-07-28T21:37:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/44af66d2e16c057c0e85e33f2a52191d90bc6e74bea1e91ba4e87164606637a9"}
{"level":"info","ts":"2026-07-28T21:37:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/fa64703a30133efac42f1759fb72f833db7edfff981fa2f94e542be81983f921"}
{"level":"info","ts":"2026-07-28T21:37:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/67116120c26f31d9d04d0f7218dd007f4c12348952c56590d8d9b2fc2e937e81"}
{"level":"info","ts":"2026-07-28T21:37:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/6ea3defb688b7a68bab2595307e4aae8164f5b1caaf32a77dc0b5fc1c94bed6e"}
{"level":"info","ts":"2026-07-28T21:37:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/3b20ec24f664f2b9575e1b6b3300c2cc221dad6002ac18b24965d9c9ed6992d6"}
{"level":"info","ts":"2026-07-28T21:37:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/506904de2eaca4760ab4e1fe25f023ecc28d83fed0d729dcc767b3988bec823e"}
{"level":"info","ts":"2026-07-28T21:37:58Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/fd59ed0fead447c46d8a578ac439debb98af93e18f091ec3ffc585b0e491fcea"}
{"level":"info","ts":"2026-07-28T21:39:15Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ea57bd47-5ea9-4710-a1cc-ca74cf34d13b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.12:35444","PortSpecifier":{"PortValue":35444}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"ea57bd47-5ea9-4710-a1cc-ca74cf34d13b","method":"POST","path":"/maas-api/v1/api-keys","host":"maas.apps.0d3a9b4b-eea4-4a9a-bf7c-8164c97d3cb1.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-28T21:39:15Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"ea57bd47-5ea9-4710-a1cc-ca74cf34d13b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.12:35444","PortSpecifier":{"PortValue":35444}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785274755,"nanos":631048360},"http":{"id":"ea57bd47-5ea9-4710-a1cc-ca74cf34d13b","method":"POST","headers":{":authority":"maas.apps.0d3a9b4b-eea4-4a9a-bf7c-8164c97d3cb1.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T21:39:15Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"ea57bd47-5ea9-4710-a1cc-ca74cf34d13b","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-28T21:39:15Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"ea57bd47-5ea9-4710-a1cc-ca74cf34d13b","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"35152220-96db-4104-b373-3d2061e53190","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=6fa0e6ab-77c9-4860-a810-b1e01ec8d6f6"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/8164c97d3cb1"]}}
{"level":"debug","ts":"2026-07-28T21:39:15Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"ea57bd47-5ea9-4710-a1cc-ca74cf34d13b","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/8164c97d3cb1"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=6fa0e6ab-77c9-4860-a810-b1e01ec8d6f6"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"35152220-96db-4104-b373-3d2061e53190","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"b64d1d3a1a41de71c5b05aa58c2da5025409dfbb29fbaa63fe6a7b8fb71bf42e"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.32:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.0d3a9b4b-eea4-4a9a-bf7c-8164c97d3cb1.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T21:39:15Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ea57bd47-5ea9-4710-a1cc-ca74cf34d13b","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T21:39:15Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ea57bd47-5ea9-4710-a1cc-ca74cf34d13b","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T21:39:15Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"ea57bd47-5ea9-4710-a1cc-ca74cf34d13b","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]},\"publishers/llm/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/llm/models/facebook/opt-125m-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T21:39:15Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"ea57bd47-5ea9-4710-a1cc-ca74cf34d13b","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyName","Value":{}},{"Name":"keyId","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-28T21:39:15Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ea57bd47-5ea9-4710-a1cc-ca74cf34d13b","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-28T21:39:15Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"ea57bd47-5ea9-4710-a1cc-ca74cf34d13b","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-28T21:39:15Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ea57bd47-5ea9-4710-a1cc-ca74cf34d13b","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-28T21:39:15Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"ea57bd47-5ea9-4710-a1cc-ca74cf34d13b","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-28T21:39:15Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"aa3d9462-952a-4d74-a978-e0c03645ec0b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.12:35448","PortSpecifier":{"PortValue":35448}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"aa3d9462-952a-4d74-a978-e0c03645ec0b","method":"POST","path":"/llm/facebook-opt-125m-simulated/v1/chat/completions","host":"maas.apps.0d3a9b4b-eea4-4a9a-bf7c-8164c97d3cb1.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-28T21:39:15Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"aa3d9462-952a-4d74-a978-e0c03645ec0b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.12:35448","PortSpecifier":{"PortValue":35448}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.32:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785274755,"nanos":679070030},"http":{"id":"aa3d9462-952a-4d74-a978-e0c03645ec0b","method":"POST","headers":{":authority":"maas.apps.0d3a9b4b-eea4-4a9a-bf7c-8164c97d3cb1.prod.konfluxeaas.com",":method":"POST",":path":"/llm/facebook-opt-125m-simulated/v1/chat/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T21:39:15Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"aa3d9462-952a-4d74-a978-e0c03645ec0b","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1EcD7cDUdv4ZDqn8f_YGRIWvrCt8xDe6VmwP8GW1NTkvvkJOqW0D6H6wG13jL"}
{"level":"debug","ts":"2026-07-28T21:39:15Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"aa3d9462-952a-4d74-a978-e0c03645ec0b","config":"apiKeyValidation","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1EcD7cDUdv4ZDqn8f_YGRIWvrCt8xDe6VmwP8GW1NTkvvkJOqW0D6H6wG13jL\"}"}
{"level":"debug","ts":"2026-07-28T21:39:15Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"aa3d9462-952a-4d74-a978-e0c03645ec0b","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"d3c294c8-d623-40d8-b3fb-a56b6a288fd3","keyName":"e2e-ipp-default","subscription":"simulator-subscription","tenant":"models-as-a-service","userId":"d3c294c8-d623-40d8-b3fb-a56b6a288fd3","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-28T21:39:15Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"aa3d9462-952a-4d74-a978-e0c03645ec0b","config":"subscription-info","method":"POST","url":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"llm/facebook-opt-125m-simulated\",\"requestedSubscription\":\"simulator-subscription\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-28T21:39:15Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"aa3d9462-952a-4d74-a978-e0c03645ec0b","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","model_name":"publishers/llm/models/facebook/opt-125m","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true,"resolvedModel":"llm/facebook-opt-125m-simulated"}}
{"level":"debug","ts":"2026-07-28T21:39:15Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"aa3d9462-952a-4d74-a978-e0c03645ec0b","input":{"auth":{"identity":"Bearer **** subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","model_name":"publishers/llm/models/facebook/opt-125m","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true,"resolvedModel":"llm/facebook-opt-125m-simulated"}}},"context":{"context_extensions":{"host":"311b1be286674fd5684c9ac59b318287dade9769cfe4aeebd8c88e2dc6b72418"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.32:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"maas.apps.0d3a9b4b-eea4-4a9a-bf7c-8164c97d3cb1.prod.konfluxeaas.com",":method":"POST",":path":"/llm/facebook-opt-125m-simulated/v1/chat/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T21:39:15Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"aa3d9462-952a-4d74-a978-e0c03645ec0b","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T21:39:15Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"aa3d9462-952a-4d74-a978-e0c03645ec0b","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"llm/facebook-opt-125m-simulated\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"llm/premium-simulated-simulated-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]},\"publishers/llm/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/llm/models/facebook/opt-125m-premium\":{\"users\":[\"system:serviceaccount:premium-users-namespace:premium-service-account\"],\"groups\":[\"premium-user\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T21:39:15Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"aa3d9462-952a-4d74-a978-e0c03645ec0b","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T21:39:15Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"aa3d9462-952a-4d74-a978-e0c03645ec0b","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T21:39:15Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"aa3d9462-952a-4d74-a978-e0c03645ec0b","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-28T21:39:15Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"aa3d9462-952a-4d74-a978-e0c03645ec0b","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-28T21:39:15Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"aa3d9462-952a-4d74-a978-e0c03645ec0b","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"simulator-subscription"}
{"level":"debug","ts":"2026-07-28T21:39:15Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"aa3d9462-952a-4d74-a978-e0c03645ec0b","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"d3c294c8-d623-40d8-b3fb-a56b6a288fd3","keyName":"e2e-ipp-default","selected_subscription":"simulator-subscription","selected_subscription_key":"models-as-a-service/simulator-subscription@llm/facebook-opt-125m-simulated","subscription_error":"","subscription_error_message":"","subscription_info":{"description":"Free-tier subscription with 100 tokens/min rate limit","displayName":"Simulator Subscription (Free)","modelRefs":[{"description":"A simulated OPT-125M model for free-tier testing","display_name":"Facebook OPT 125M (Simulated)","model_name":"publishers/llm/models/facebook/opt-125m","name":"facebook-opt-125m-simulated","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"simulator-subscription","namespace":"models-as-a-service","phase":"Active","priority":10,"ready":true,"resolvedModel":"llm/facebook-opt-125m-simulated"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-28T21:39:15Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"aa3d9462-952a-4d74-a978-e0c03645ec0b","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-28T21:39:15Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"aa3d9462-952a-4d74-a978-e0c03645ec0b","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-28T21:39:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"748a15ba40da3c061d03a6ba3f8cf16052f9750d5216444851fc82ef2d1f31bd","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T21:39:47Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T21:39:47Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T21:39:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"748a15ba40da3c061d03a6ba3f8cf16052f9750d5216444851fc82ef2d1f31bd","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T21:39:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"748a15ba40da3c061d03a6ba3f8cf16052f9750d5216444851fc82ef2d1f31bd","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T21:39:47Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T21:39:47Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T21:39:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/748a15ba40da3c061d03a6ba3f8cf16052f9750d5216444851fc82ef2d1f31bd"}
{"level":"info","ts":"2026-07-28T21:39:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"748a15ba40da3c061d03a6ba3f8cf16052f9750d5216444851fc82ef2d1f31bd","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T21:39:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"748a15ba40da3c061d03a6ba3f8cf16052f9750d5216444851fc82ef2d1f31bd","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T21:39:47Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T21:39:47Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"error","ts":"2026-07-28T21:39:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"748a15ba40da3c061d03a6ba3f8cf16052f9750d5216444851fc82ef2d1f31bd","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"748a15ba40da3c061d03a6ba3f8cf16052f9750d5216444851fc82ef2d1f31bd\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-28T21:39:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"748a15ba40da3c061d03a6ba3f8cf16052f9750d5216444851fc82ef2d1f31bd","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-28T21:39:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/748a15ba40da3c061d03a6ba3f8cf16052f9750d5216444851fc82ef2d1f31bd"}
{"level":"debug","ts":"2026-07-28T21:39:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"748a15ba40da3c061d03a6ba3f8cf16052f9750d5216444851fc82ef2d1f31bd","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-28T21:39:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/748a15ba40da3c061d03a6ba3f8cf16052f9750d5216444851fc82ef2d1f31bd"}
{"level":"debug","ts":"2026-07-28T21:39:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"748a15ba40da3c061d03a6ba3f8cf16052f9750d5216444851fc82ef2d1f31bd","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-28T21:39:47Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-28T21:39:47Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["748a15ba40da3c061d03a6ba3f8cf16052f9750d5216444851fc82ef2d1f31bd"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T21:39:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"748a15ba40da3c061d03a6ba3f8cf16052f9750d5216444851fc82ef2d1f31bd","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T21:39:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"748a15ba40da3c061d03a6ba3f8cf16052f9750d5216444851fc82ef2d1f31bd","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T21:39:47Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T21:39:47Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T21:39:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"748a15ba40da3c061d03a6ba3f8cf16052f9750d5216444851fc82ef2d1f31bd","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T21:39:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"748a15ba40da3c061d03a6ba3f8cf16052f9750d5216444851fc82ef2d1f31bd","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T21:39:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"748a15ba40da3c061d03a6ba3f8cf16052f9750d5216444851fc82ef2d1f31bd","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-28T21:39:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/748a15ba40da3c061d03a6ba3f8cf16052f9750d5216444851fc82ef2d1f31bd"}
{"level":"debug","ts":"2026-07-28T21:39:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"748a15ba40da3c061d03a6ba3f8cf16052f9750d5216444851fc82ef2d1f31bd","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-28T21:39:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/748a15ba40da3c061d03a6ba3f8cf16052f9750d5216444851fc82ef2d1f31bd"}
{"level":"debug","ts":"2026-07-28T21:39:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"748a15ba40da3c061d03a6ba3f8cf16052f9750d5216444851fc82ef2d1f31bd","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-28T21:39:47Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-28T21:39:47Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["748a15ba40da3c061d03a6ba3f8cf16052f9750d5216444851fc82ef2d1f31bd"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T21:39:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"748a15ba40da3c061d03a6ba3f8cf16052f9750d5216444851fc82ef2d1f31bd","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T21:39:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"748a15ba40da3c061d03a6ba3f8cf16052f9750d5216444851fc82ef2d1f31bd","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T21:39:47Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T21:39:47Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T21:39:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"748a15ba40da3c061d03a6ba3f8cf16052f9750d5216444851fc82ef2d1f31bd","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T21:39:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"748a15ba40da3c061d03a6ba3f8cf16052f9750d5216444851fc82ef2d1f31bd","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T21:39:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"748a15ba40da3c061d03a6ba3f8cf16052f9750d5216444851fc82ef2d1f31bd","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-28T21:39:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/748a15ba40da3c061d03a6ba3f8cf16052f9750d5216444851fc82ef2d1f31bd"}
{"level":"debug","ts":"2026-07-28T21:39:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"748a15ba40da3c061d03a6ba3f8cf16052f9750d5216444851fc82ef2d1f31bd","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-28T21:39:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/748a15ba40da3c061d03a6ba3f8cf16052f9750d5216444851fc82ef2d1f31bd"}
{"level":"debug","ts":"2026-07-28T21:39:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f045dad595b8553b68978bf7b7a817e0672774bf1353f1f162bf452df461e394","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T21:39:47Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T21:39:47Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T21:39:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f045dad595b8553b68978bf7b7a817e0672774bf1353f1f162bf452df461e394","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T21:39:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f045dad595b8553b68978bf7b7a817e0672774bf1353f1f162bf452df461e394","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T21:39:47Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T21:39:47Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T21:39:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f045dad595b8553b68978bf7b7a817e0672774bf1353f1f162bf452df461e394"}
{"level":"info","ts":"2026-07-28T21:39:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f045dad595b8553b68978bf7b7a817e0672774bf1353f1f162bf452df461e394","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T21:39:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"748a15ba40da3c061d03a6ba3f8cf16052f9750d5216444851fc82ef2d1f31bd","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-28T21:39:47Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-28T21:39:47Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["748a15ba40da3c061d03a6ba3f8cf16052f9750d5216444851fc82ef2d1f31bd"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T21:39:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f045dad595b8553b68978bf7b7a817e0672774bf1353f1f162bf452df461e394"}
{"level":"info","ts":"2026-07-28T21:39:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"748a15ba40da3c061d03a6ba3f8cf16052f9750d5216444851fc82ef2d1f31bd","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T21:39:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f045dad595b8553b68978bf7b7a817e0672774bf1353f1f162bf452df461e394","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T21:39:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"748a15ba40da3c061d03a6ba3f8cf16052f9750d5216444851fc82ef2d1f31bd","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-28T21:39:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f045dad595b8553b68978bf7b7a817e0672774bf1353f1f162bf452df461e394"}
{"level":"debug","ts":"2026-07-28T21:39:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"f045dad595b8553b68978bf7b7a817e0672774bf1353f1f162bf452df461e394","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-28T21:39:47Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-28T21:39:47Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["f045dad595b8553b68978bf7b7a817e0672774bf1353f1f162bf452df461e394"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T21:39:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"f045dad595b8553b68978bf7b7a817e0672774bf1353f1f162bf452df461e394","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T21:39:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"f045dad595b8553b68978bf7b7a817e0672774bf1353f1f162bf452df461e394","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-28T21:39:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/748a15ba40da3c061d03a6ba3f8cf16052f9750d5216444851fc82ef2d1f31bd"}
{"level":"debug","ts":"2026-07-28T21:39:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"cd2ffcb47011af82ef11ee53aa5a98d964ee56ef2444c698024c7a03d262f109","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T21:39:47Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T21:39:47Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T21:39:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"cd2ffcb47011af82ef11ee53aa5a98d964ee56ef2444c698024c7a03d262f109","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T21:39:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"cd2ffcb47011af82ef11ee53aa5a98d964ee56ef2444c698024c7a03d262f109","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-28T21:39:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/f045dad595b8553b68978bf7b7a817e0672774bf1353f1f162bf452df461e394"}
{"level":"debug","ts":"2026-07-28T21:39:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"cd2ffcb47011af82ef11ee53aa5a98d964ee56ef2444c698024c7a03d262f109","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T21:39:47Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T21:39:47Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T21:39:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"cd2ffcb47011af82ef11ee53aa5a98d964ee56ef2444c698024c7a03d262f109","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T21:39:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"cd2ffcb47011af82ef11ee53aa5a98d964ee56ef2444c698024c7a03d262f109","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-28T21:39:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/cd2ffcb47011af82ef11ee53aa5a98d964ee56ef2444c698024c7a03d262f109"}
{"level":"debug","ts":"2026-07-28T21:39:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"cd2ffcb47011af82ef11ee53aa5a98d964ee56ef2444c698024c7a03d262f109","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-28T21:39:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/cd2ffcb47011af82ef11ee53aa5a98d964ee56ef2444c698024c7a03d262f109"}
{"level":"debug","ts":"2026-07-28T21:39:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5edae3419a4cc040d8f09ea257ca46439fc0ff0a765d34e872f40d6f6d65d1a8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T21:39:47Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T21:39:47Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T21:39:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5edae3419a4cc040d8f09ea257ca46439fc0ff0a765d34e872f40d6f6d65d1a8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T21:39:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5edae3419a4cc040d8f09ea257ca46439fc0ff0a765d34e872f40d6f6d65d1a8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T21:39:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5edae3419a4cc040d8f09ea257ca46439fc0ff0a765d34e872f40d6f6d65d1a8","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-28T21:39:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5edae3419a4cc040d8f09ea257ca46439fc0ff0a765d34e872f40d6f6d65d1a8"}
{"level":"debug","ts":"2026-07-28T21:39:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"cd2ffcb47011af82ef11ee53aa5a98d964ee56ef2444c698024c7a03d262f109","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-28T21:39:47Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-28T21:39:47Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["cd2ffcb47011af82ef11ee53aa5a98d964ee56ef2444c698024c7a03d262f109"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T21:39:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"cd2ffcb47011af82ef11ee53aa5a98d964ee56ef2444c698024c7a03d262f109","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T21:39:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5edae3419a4cc040d8f09ea257ca46439fc0ff0a765d34e872f40d6f6d65d1a8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T21:39:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"cd2ffcb47011af82ef11ee53aa5a98d964ee56ef2444c698024c7a03d262f109","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-28T21:39:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5edae3419a4cc040d8f09ea257ca46439fc0ff0a765d34e872f40d6f6d65d1a8"}
{"level":"info","ts":"2026-07-28T21:39:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/cd2ffcb47011af82ef11ee53aa5a98d964ee56ef2444c698024c7a03d262f109"}
{"level":"debug","ts":"2026-07-28T21:39:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"5edae3419a4cc040d8f09ea257ca46439fc0ff0a765d34e872f40d6f6d65d1a8","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-28T21:39:47Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-28T21:39:47Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["5edae3419a4cc040d8f09ea257ca46439fc0ff0a765d34e872f40d6f6d65d1a8"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T21:39:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"5edae3419a4cc040d8f09ea257ca46439fc0ff0a765d34e872f40d6f6d65d1a8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T21:39:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c9a32f829f27f1167492f2563a416508ccc837099ba33f289849e5b1b9fe0643","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T21:39:47Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T21:39:47Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T21:39:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c9a32f829f27f1167492f2563a416508ccc837099ba33f289849e5b1b9fe0643","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T21:39:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5edae3419a4cc040d8f09ea257ca46439fc0ff0a765d34e872f40d6f6d65d1a8","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T21:39:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c9a32f829f27f1167492f2563a416508ccc837099ba33f289849e5b1b9fe0643","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-28T21:39:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c9a32f829f27f1167492f2563a416508ccc837099ba33f289849e5b1b9fe0643"}
{"level":"debug","ts":"2026-07-28T21:39:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c9a32f829f27f1167492f2563a416508ccc837099ba33f289849e5b1b9fe0643","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-28T21:39:47Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-28T21:39:47Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["c9a32f829f27f1167492f2563a416508ccc837099ba33f289849e5b1b9fe0643"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T21:39:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c9a32f829f27f1167492f2563a416508ccc837099ba33f289849e5b1b9fe0643","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T21:39:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c9a32f829f27f1167492f2563a416508ccc837099ba33f289849e5b1b9fe0643","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-28T21:39:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5edae3419a4cc040d8f09ea257ca46439fc0ff0a765d34e872f40d6f6d65d1a8"}
{"level":"info","ts":"2026-07-28T21:39:47Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c9a32f829f27f1167492f2563a416508ccc837099ba33f289849e5b1b9fe0643"}
{"level":"debug","ts":"2026-07-28T21:39:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"51068d56ebfbc1c28217ed6a40aa0856fa76cecd7411bbc6140135f8826ce45f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T21:39:48Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T21:39:48Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T21:39:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"51068d56ebfbc1c28217ed6a40aa0856fa76cecd7411bbc6140135f8826ce45f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T21:39:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"51068d56ebfbc1c28217ed6a40aa0856fa76cecd7411bbc6140135f8826ce45f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T21:39:48Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T21:39:48Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T21:39:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/51068d56ebfbc1c28217ed6a40aa0856fa76cecd7411bbc6140135f8826ce45f"}
{"level":"info","ts":"2026-07-28T21:39:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"51068d56ebfbc1c28217ed6a40aa0856fa76cecd7411bbc6140135f8826ce45f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T21:39:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"51068d56ebfbc1c28217ed6a40aa0856fa76cecd7411bbc6140135f8826ce45f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T21:39:48Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T21:39:48Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"error","ts":"2026-07-28T21:39:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"51068d56ebfbc1c28217ed6a40aa0856fa76cecd7411bbc6140135f8826ce45f","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"51068d56ebfbc1c28217ed6a40aa0856fa76cecd7411bbc6140135f8826ce45f\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-28T21:39:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"51068d56ebfbc1c28217ed6a40aa0856fa76cecd7411bbc6140135f8826ce45f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T21:39:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"51068d56ebfbc1c28217ed6a40aa0856fa76cecd7411bbc6140135f8826ce45f","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-28T21:39:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/51068d56ebfbc1c28217ed6a40aa0856fa76cecd7411bbc6140135f8826ce45f"}
{"level":"info","ts":"2026-07-28T21:39:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/51068d56ebfbc1c28217ed6a40aa0856fa76cecd7411bbc6140135f8826ce45f"}
{"level":"debug","ts":"2026-07-28T21:39:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e9f1824bc62a6115d37ced35b3e3848ded0c2a9d0ab69ba748cccba5ced53f71","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T21:39:48Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T21:39:48Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T21:39:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e9f1824bc62a6115d37ced35b3e3848ded0c2a9d0ab69ba748cccba5ced53f71","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T21:39:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"984dc4537a47c8b156b76df2500bb5af1865f22cb6b3c9eeee0a5b4900d4ad4a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T21:39:48Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T21:39:48Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T21:39:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e9f1824bc62a6115d37ced35b3e3848ded0c2a9d0ab69ba748cccba5ced53f71"}
{"level":"info","ts":"2026-07-28T21:39:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"984dc4537a47c8b156b76df2500bb5af1865f22cb6b3c9eeee0a5b4900d4ad4a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T21:39:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e9f1824bc62a6115d37ced35b3e3848ded0c2a9d0ab69ba748cccba5ced53f71","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-28T21:39:48Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-28T21:39:48Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["e9f1824bc62a6115d37ced35b3e3848ded0c2a9d0ab69ba748cccba5ced53f71"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T21:39:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e9f1824bc62a6115d37ced35b3e3848ded0c2a9d0ab69ba748cccba5ced53f71","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T21:39:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"51068d56ebfbc1c28217ed6a40aa0856fa76cecd7411bbc6140135f8826ce45f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-28T21:39:48Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-28T21:39:48Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["51068d56ebfbc1c28217ed6a40aa0856fa76cecd7411bbc6140135f8826ce45f"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T21:39:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/984dc4537a47c8b156b76df2500bb5af1865f22cb6b3c9eeee0a5b4900d4ad4a"}
{"level":"info","ts":"2026-07-28T21:39:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"51068d56ebfbc1c28217ed6a40aa0856fa76cecd7411bbc6140135f8826ce45f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T21:39:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"984dc4537a47c8b156b76df2500bb5af1865f22cb6b3c9eeee0a5b4900d4ad4a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-28T21:39:48Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-28T21:39:48Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["984dc4537a47c8b156b76df2500bb5af1865f22cb6b3c9eeee0a5b4900d4ad4a"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T21:39:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"984dc4537a47c8b156b76df2500bb5af1865f22cb6b3c9eeee0a5b4900d4ad4a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T21:39:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e9f1824bc62a6115d37ced35b3e3848ded0c2a9d0ab69ba748cccba5ced53f71","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T21:39:48Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T21:39:48Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T21:39:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e9f1824bc62a6115d37ced35b3e3848ded0c2a9d0ab69ba748cccba5ced53f71"}
{"level":"info","ts":"2026-07-28T21:39:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e9f1824bc62a6115d37ced35b3e3848ded0c2a9d0ab69ba748cccba5ced53f71","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T21:39:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"51068d56ebfbc1c28217ed6a40aa0856fa76cecd7411bbc6140135f8826ce45f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T21:39:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"984dc4537a47c8b156b76df2500bb5af1865f22cb6b3c9eeee0a5b4900d4ad4a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T21:39:48Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T21:39:48Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T21:39:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"984dc4537a47c8b156b76df2500bb5af1865f22cb6b3c9eeee0a5b4900d4ad4a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T21:39:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e9f1824bc62a6115d37ced35b3e3848ded0c2a9d0ab69ba748cccba5ced53f71","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-28T21:39:48Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-28T21:39:48Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["e9f1824bc62a6115d37ced35b3e3848ded0c2a9d0ab69ba748cccba5ced53f71"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T21:39:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/984dc4537a47c8b156b76df2500bb5af1865f22cb6b3c9eeee0a5b4900d4ad4a"}
{"level":"info","ts":"2026-07-28T21:39:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e9f1824bc62a6115d37ced35b3e3848ded0c2a9d0ab69ba748cccba5ced53f71","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T21:39:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"984dc4537a47c8b156b76df2500bb5af1865f22cb6b3c9eeee0a5b4900d4ad4a","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-28T21:39:48Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-28T21:39:48Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["984dc4537a47c8b156b76df2500bb5af1865f22cb6b3c9eeee0a5b4900d4ad4a"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T21:39:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"984dc4537a47c8b156b76df2500bb5af1865f22cb6b3c9eeee0a5b4900d4ad4a","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T21:39:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e9f1824bc62a6115d37ced35b3e3848ded0c2a9d0ab69ba748cccba5ced53f71","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T21:39:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"984dc4537a47c8b156b76df2500bb5af1865f22cb6b3c9eeee0a5b4900d4ad4a","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-28T21:39:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/51068d56ebfbc1c28217ed6a40aa0856fa76cecd7411bbc6140135f8826ce45f"}
{"level":"info","ts":"2026-07-28T21:39:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e9f1824bc62a6115d37ced35b3e3848ded0c2a9d0ab69ba748cccba5ced53f71"}
{"level":"info","ts":"2026-07-28T21:39:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/984dc4537a47c8b156b76df2500bb5af1865f22cb6b3c9eeee0a5b4900d4ad4a"}
{"level":"debug","ts":"2026-07-28T21:39:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"230fb637eb0935a4bdc5b5d9c415697547bf427a2e8c30825b625f2d9012f210","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T21:39:48Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T21:39:48Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T21:39:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"230fb637eb0935a4bdc5b5d9c415697547bf427a2e8c30825b625f2d9012f210","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T21:39:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c4e495fe5ff82c20aad4983c573e1c2ad1faa8d35309e38b101a81b0701c326b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T21:39:48Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T21:39:48Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T21:39:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c4e495fe5ff82c20aad4983c573e1c2ad1faa8d35309e38b101a81b0701c326b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T21:39:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"230fb637eb0935a4bdc5b5d9c415697547bf427a2e8c30825b625f2d9012f210","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T21:39:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c4e495fe5ff82c20aad4983c573e1c2ad1faa8d35309e38b101a81b0701c326b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T21:39:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c4e495fe5ff82c20aad4983c573e1c2ad1faa8d35309e38b101a81b0701c326b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T21:39:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"230fb637eb0935a4bdc5b5d9c415697547bf427a2e8c30825b625f2d9012f210","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-28T21:39:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/230fb637eb0935a4bdc5b5d9c415697547bf427a2e8c30825b625f2d9012f210"}
{"level":"debug","ts":"2026-07-28T21:39:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c4e495fe5ff82c20aad4983c573e1c2ad1faa8d35309e38b101a81b0701c326b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T21:39:48Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T21:39:48Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T21:39:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c4e495fe5ff82c20aad4983c573e1c2ad1faa8d35309e38b101a81b0701c326b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T21:39:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"230fb637eb0935a4bdc5b5d9c415697547bf427a2e8c30825b625f2d9012f210","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-28T21:39:48Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-28T21:39:48Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["230fb637eb0935a4bdc5b5d9c415697547bf427a2e8c30825b625f2d9012f210"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T21:39:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"230fb637eb0935a4bdc5b5d9c415697547bf427a2e8c30825b625f2d9012f210","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T21:39:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c4e495fe5ff82c20aad4983c573e1c2ad1faa8d35309e38b101a81b0701c326b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T21:39:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"230fb637eb0935a4bdc5b5d9c415697547bf427a2e8c30825b625f2d9012f210","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-28T21:39:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c4e495fe5ff82c20aad4983c573e1c2ad1faa8d35309e38b101a81b0701c326b"}
{"level":"debug","ts":"2026-07-28T21:39:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2b2d11f3325097443572639ecb956eab8fc4f180992aca0d7197746a4d9cc17b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T21:39:48Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T21:39:48Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T21:39:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2b2d11f3325097443572639ecb956eab8fc4f180992aca0d7197746a4d9cc17b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T21:39:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9defb191f02fe365075d3b9b3d24bf833aab8e3b264a300582202a99732f0397","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T21:39:48Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T21:39:48Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T21:39:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/230fb637eb0935a4bdc5b5d9c415697547bf427a2e8c30825b625f2d9012f210"}
{"level":"info","ts":"2026-07-28T21:39:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9defb191f02fe365075d3b9b3d24bf833aab8e3b264a300582202a99732f0397","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T21:39:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2b2d11f3325097443572639ecb956eab8fc4f180992aca0d7197746a4d9cc17b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T21:39:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c4e495fe5ff82c20aad4983c573e1c2ad1faa8d35309e38b101a81b0701c326b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T21:39:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9defb191f02fe365075d3b9b3d24bf833aab8e3b264a300582202a99732f0397","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T21:39:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9defb191f02fe365075d3b9b3d24bf833aab8e3b264a300582202a99732f0397","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T21:39:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2b2d11f3325097443572639ecb956eab8fc4f180992aca0d7197746a4d9cc17b","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-28T21:39:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c4e495fe5ff82c20aad4983c573e1c2ad1faa8d35309e38b101a81b0701c326b"}
{"level":"debug","ts":"2026-07-28T21:39:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9defb191f02fe365075d3b9b3d24bf833aab8e3b264a300582202a99732f0397","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T21:39:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2b2d11f3325097443572639ecb956eab8fc4f180992aca0d7197746a4d9cc17b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T21:39:48Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T21:39:48Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T21:39:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2b2d11f3325097443572639ecb956eab8fc4f180992aca0d7197746a4d9cc17b"}
{"level":"info","ts":"2026-07-28T21:39:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2b2d11f3325097443572639ecb956eab8fc4f180992aca0d7197746a4d9cc17b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T21:39:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2b2d11f3325097443572639ecb956eab8fc4f180992aca0d7197746a4d9cc17b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-28T21:39:48Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-28T21:39:48Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["2b2d11f3325097443572639ecb956eab8fc4f180992aca0d7197746a4d9cc17b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T21:39:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9defb191f02fe365075d3b9b3d24bf833aab8e3b264a300582202a99732f0397"}
{"level":"info","ts":"2026-07-28T21:39:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2b2d11f3325097443572639ecb956eab8fc4f180992aca0d7197746a4d9cc17b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T21:39:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2b2d11f3325097443572639ecb956eab8fc4f180992aca0d7197746a4d9cc17b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T21:39:48Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T21:39:48Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T21:39:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2b2d11f3325097443572639ecb956eab8fc4f180992aca0d7197746a4d9cc17b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T21:39:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9defb191f02fe365075d3b9b3d24bf833aab8e3b264a300582202a99732f0397","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-28T21:39:48Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-28T21:39:48Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["9defb191f02fe365075d3b9b3d24bf833aab8e3b264a300582202a99732f0397"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T21:39:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2b2d11f3325097443572639ecb956eab8fc4f180992aca0d7197746a4d9cc17b"}
{"level":"info","ts":"2026-07-28T21:39:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2b2d11f3325097443572639ecb956eab8fc4f180992aca0d7197746a4d9cc17b"}
{"level":"info","ts":"2026-07-28T21:39:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9defb191f02fe365075d3b9b3d24bf833aab8e3b264a300582202a99732f0397","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T21:39:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"2b2d11f3325097443572639ecb956eab8fc4f180992aca0d7197746a4d9cc17b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-28T21:39:48Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-28T21:39:48Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["2b2d11f3325097443572639ecb956eab8fc4f180992aca0d7197746a4d9cc17b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T21:39:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"2b2d11f3325097443572639ecb956eab8fc4f180992aca0d7197746a4d9cc17b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T21:39:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9defb191f02fe365075d3b9b3d24bf833aab8e3b264a300582202a99732f0397","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T21:39:48Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T21:39:48Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T21:39:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9defb191f02fe365075d3b9b3d24bf833aab8e3b264a300582202a99732f0397"}
{"level":"info","ts":"2026-07-28T21:39:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2b2d11f3325097443572639ecb956eab8fc4f180992aca0d7197746a4d9cc17b"}
{"level":"info","ts":"2026-07-28T21:39:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9defb191f02fe365075d3b9b3d24bf833aab8e3b264a300582202a99732f0397","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T21:39:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2b2d11f3325097443572639ecb956eab8fc4f180992aca0d7197746a4d9cc17b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T21:39:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"c4e495fe5ff82c20aad4983c573e1c2ad1faa8d35309e38b101a81b0701c326b","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-28T21:39:48Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-28T21:39:48Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["c4e495fe5ff82c20aad4983c573e1c2ad1faa8d35309e38b101a81b0701c326b"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T21:39:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9defb191f02fe365075d3b9b3d24bf833aab8e3b264a300582202a99732f0397"}
{"level":"info","ts":"2026-07-28T21:39:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"c4e495fe5ff82c20aad4983c573e1c2ad1faa8d35309e38b101a81b0701c326b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T21:39:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9defb191f02fe365075d3b9b3d24bf833aab8e3b264a300582202a99732f0397","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-28T21:39:48Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-28T21:39:48Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["9defb191f02fe365075d3b9b3d24bf833aab8e3b264a300582202a99732f0397"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T21:39:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c4e495fe5ff82c20aad4983c573e1c2ad1faa8d35309e38b101a81b0701c326b"}
{"level":"info","ts":"2026-07-28T21:39:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9defb191f02fe365075d3b9b3d24bf833aab8e3b264a300582202a99732f0397","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T21:39:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c4e495fe5ff82c20aad4983c573e1c2ad1faa8d35309e38b101a81b0701c326b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T21:39:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9defb191f02fe365075d3b9b3d24bf833aab8e3b264a300582202a99732f0397","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T21:39:48Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T21:39:48Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T21:39:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9defb191f02fe365075d3b9b3d24bf833aab8e3b264a300582202a99732f0397"}
{"level":"info","ts":"2026-07-28T21:39:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9defb191f02fe365075d3b9b3d24bf833aab8e3b264a300582202a99732f0397","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T21:39:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9defb191f02fe365075d3b9b3d24bf833aab8e3b264a300582202a99732f0397","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-28T21:39:48Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-28T21:39:48Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["9defb191f02fe365075d3b9b3d24bf833aab8e3b264a300582202a99732f0397"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T21:39:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9defb191f02fe365075d3b9b3d24bf833aab8e3b264a300582202a99732f0397","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T21:39:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9defb191f02fe365075d3b9b3d24bf833aab8e3b264a300582202a99732f0397","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T21:39:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9defb191f02fe365075d3b9b3d24bf833aab8e3b264a300582202a99732f0397","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T21:39:48Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T21:39:48Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T21:39:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9defb191f02fe365075d3b9b3d24bf833aab8e3b264a300582202a99732f0397"}
{"level":"info","ts":"2026-07-28T21:39:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9defb191f02fe365075d3b9b3d24bf833aab8e3b264a300582202a99732f0397","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T21:39:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9defb191f02fe365075d3b9b3d24bf833aab8e3b264a300582202a99732f0397","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-28T21:39:48Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-28T21:39:48Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"error","ts":"2026-07-28T21:39:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"9defb191f02fe365075d3b9b3d24bf833aab8e3b264a300582202a99732f0397","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"9defb191f02fe365075d3b9b3d24bf833aab8e3b264a300582202a99732f0397\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-28T21:39:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9defb191f02fe365075d3b9b3d24bf833aab8e3b264a300582202a99732f0397","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T21:39:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9defb191f02fe365075d3b9b3d24bf833aab8e3b264a300582202a99732f0397","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-28T21:39:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9defb191f02fe365075d3b9b3d24bf833aab8e3b264a300582202a99732f0397"}
{"level":"info","ts":"2026-07-28T21:39:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9defb191f02fe365075d3b9b3d24bf833aab8e3b264a300582202a99732f0397"}
{"level":"debug","ts":"2026-07-28T21:39:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"9defb191f02fe365075d3b9b3d24bf833aab8e3b264a300582202a99732f0397","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-28T21:39:48Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-28T21:39:48Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["9defb191f02fe365075d3b9b3d24bf833aab8e3b264a300582202a99732f0397"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-28T21:39:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"9defb191f02fe365075d3b9b3d24bf833aab8e3b264a300582202a99732f0397","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-28T21:39:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"9defb191f02fe365075d3b9b3d24bf833aab8e3b264a300582202a99732f0397","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-28T21:39:48Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/9defb191f02fe365075d3b9b3d24bf833aab8e3b264a300582202a99732f0397"}
{"level":"info","ts":"2026-07-28T21:40:05Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"db19dd51-cda8-4dca-97aa-a54547dc32a1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.12:56070","PortSpecifier":{"PortValue":56070}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.38:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"db19dd51-cda8-4dca-97aa-a54547dc32a1","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-ipp-a-cf1484.apps.0d3a9b4b-eea4-4a9a-bf7c-8164c97d3cb1.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-28T21:40:05Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"db19dd51-cda8-4dca-97aa-a54547dc32a1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.12:56070","PortSpecifier":{"PortValue":56070}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.38:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785274805,"nanos":554333379},"http":{"id":"db19dd51-cda8-4dca-97aa-a54547dc32a1","method":"POST","headers":{":authority":"e2e-ipp-a-cf1484.apps.0d3a9b4b-eea4-4a9a-bf7c-8164c97d3cb1.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T21:40:05Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"db19dd51-cda8-4dca-97aa-a54547dc32a1","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-28T21:40:05Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"db19dd51-cda8-4dca-97aa-a54547dc32a1","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"35152220-96db-4104-b373-3d2061e53190","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=6fa0e6ab-77c9-4860-a810-b1e01ec8d6f6"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/8164c97d3cb1"]}}
{"level":"debug","ts":"2026-07-28T21:40:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"db19dd51-cda8-4dca-97aa-a54547dc32a1","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/8164c97d3cb1"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=6fa0e6ab-77c9-4860-a810-b1e01ec8d6f6"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"35152220-96db-4104-b373-3d2061e53190","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"f045dad595b8553b68978bf7b7a817e0672774bf1353f1f162bf452df461e394"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.38:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-ipp-a-cf1484.apps.0d3a9b4b-eea4-4a9a-bf7c-8164c97d3cb1.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T21:40:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"db19dd51-cda8-4dca-97aa-a54547dc32a1","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T21:40:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"db19dd51-cda8-4dca-97aa-a54547dc32a1","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T21:40:05Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"db19dd51-cda8-4dca-97aa-a54547dc32a1","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-ipp-a-cf1484/ipp-route-cf1484\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-ipp-a-cf1484/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T21:40:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"db19dd51-cda8-4dca-97aa-a54547dc32a1","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"groups","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-28T21:40:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"db19dd51-cda8-4dca-97aa-a54547dc32a1","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-28T21:40:05Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"db19dd51-cda8-4dca-97aa-a54547dc32a1","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-28T21:40:05Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"db19dd51-cda8-4dca-97aa-a54547dc32a1","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-28T21:40:05Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"db19dd51-cda8-4dca-97aa-a54547dc32a1","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-28T21:40:07Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"03fe8a74-4813-4930-acb5-862c2cc6f6db","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.12:56076","PortSpecifier":{"PortValue":56076}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.38:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"03fe8a74-4813-4930-acb5-862c2cc6f6db","method":"POST","path":"/ai-tenant-e2e-ipp-a-cf1484/ipp-route-cf1484/v1/chat/completions","host":"e2e-ipp-a-cf1484.apps.0d3a9b4b-eea4-4a9a-bf7c-8164c97d3cb1.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-28T21:40:07Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"03fe8a74-4813-4930-acb5-862c2cc6f6db","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.12:56076","PortSpecifier":{"PortValue":56076}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.38:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1785274807,"nanos":614647277},"http":{"id":"03fe8a74-4813-4930-acb5-862c2cc6f6db","method":"POST","headers":{":authority":"e2e-ipp-a-cf1484.apps.0d3a9b4b-eea4-4a9a-bf7c-8164c97d3cb1.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-ipp-a-cf1484/ipp-route-cf1484/v1/chat/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T21:40:07Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"03fe8a74-4813-4930-acb5-862c2cc6f6db","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-VZqC5L31r73LjxZp_kU5hZGQ7k7ucLyr2YOA0V54F60ujKSAxLrJPpZApocX"}
{"level":"debug","ts":"2026-07-28T21:40:07Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"03fe8a74-4813-4930-acb5-862c2cc6f6db","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-ipp-a-cf1484.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-VZqC5L31r73LjxZp_kU5hZGQ7k7ucLyr2YOA0V54F60ujKSAxLrJPpZApocX\"}"}
{"level":"debug","ts":"2026-07-28T21:40:07Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"03fe8a74-4813-4930-acb5-862c2cc6f6db","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-ipp-a-cf1484.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"75d7ba51-093e-4c0c-b16a-d85f8576ca35","keyName":"e2e-ipp-cf1484","subscription":"ipp-route-cf1484-sub","tenant":"e2e-ipp-a-cf1484","userId":"75d7ba51-093e-4c0c-b16a-d85f8576ca35","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-28T21:40:07Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"03fe8a74-4813-4930-acb5-862c2cc6f6db","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-ipp-a-cf1484.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-ipp-a-cf1484/ipp-route-cf1484\",\"requestedSubscription\":\"ipp-route-cf1484-sub\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-28T21:40:07Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"03fe8a74-4813-4930-acb5-862c2cc6f6db","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-ipp-a-cf1484.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-ipp-a-cf1484/models/facebook/opt-125m","name":"ipp-route-cf1484","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"ipp-route-cf1484-sub","namespace":"ai-tenant-e2e-ipp-a-cf1484","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-ipp-a-cf1484/ipp-route-cf1484"}}
{"level":"debug","ts":"2026-07-28T21:40:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"03fe8a74-4813-4930-acb5-862c2cc6f6db","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-28T21:40:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"03fe8a74-4813-4930-acb5-862c2cc6f6db","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T21:40:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"03fe8a74-4813-4930-acb5-862c2cc6f6db","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T21:40:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"03fe8a74-4813-4930-acb5-862c2cc6f6db","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-ipp-a-cf1484/ipp-route-cf1484\":{\"users\":null,\"groups\":[\"system:authenticated\"]},\"publishers/ai-tenant-e2e-ipp-a-cf1484/models/facebook/opt-125m\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nheader_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T21:40:07Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"03fe8a74-4813-4930-acb5-862c2cc6f6db","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-28T21:40:07Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"03fe8a74-4813-4930-acb5-862c2cc6f6db","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-28T21:40:07Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"03fe8a74-4813-4930-acb5-862c2cc6f6db","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-28T21:40:07Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"03fe8a74-4813-4930-acb5-862c2cc6f6db","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"ipp-route-cf1484-sub"}
{"level":"debug","ts":"2026-07-28T21:40:07Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"03fe8a74-4813-4930-acb5-862c2cc6f6db","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"75d7ba51-093e-4c0c-b16a-d85f8576ca35","keyName":"e2e-ipp-cf1484","selected_subscription":"ipp-route-cf1484-sub","selected_subscription_key":"ai-tenant-e2e-ipp-a-cf1484/ipp-route-cf1484-sub@ai-tenant-e2e-ipp-a-cf1484/ipp-route-cf1484","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"model_name":"publishers/ai-tenant-e2e-ipp-a-cf1484/models/facebook/opt-125m","name":"ipp-route-cf1484","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"ipp-route-cf1484-sub","namespace":"ai-tenant-e2e-ipp-a-cf1484","phase":"Active","ready":true,"resolvedModel":"ai-tenant-e2e-ipp-a-cf1484/ipp-route-cf1484"},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-28T21:40:07Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"03fe8a74-4813-4930-acb5-862c2cc6f6db","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-28T21:40:07Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"03fe8a74-4813-4930-acb5-862c2cc6f6db","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-28T21:41:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/cd2ffcb47011af82ef11ee53aa5a98d964ee56ef2444c698024c7a03d262f109"}
{"level":"info","ts":"2026-07-28T21:41:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/51068d56ebfbc1c28217ed6a40aa0856fa76cecd7411bbc6140135f8826ce45f"}
{"level":"info","ts":"2026-07-28T21:41:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/748a15ba40da3c061d03a6ba3f8cf16052f9750d5216444851fc82ef2d1f31bd"}
{"level":"info","ts":"2026-07-28T21:41:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/984dc4537a47c8b156b76df2500bb5af1865f22cb6b3c9eeee0a5b4900d4ad4a"}
{"level":"info","ts":"2026-07-28T21:41:08Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/c9a32f829f27f1167492f2563a416508ccc837099ba33f289849e5b1b9fe0643"}
{"level":"info","ts":"2026-07-28T21:41:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/230fb637eb0935a4bdc5b5d9c415697547bf427a2e8c30825b625f2d9012f210"}
{"level":"info","ts":"2026-07-28T21:41:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/e9f1824bc62a6115d37ced35b3e3848ded0c2a9d0ab69ba748cccba5ced53f71"}
{"level":"info","ts":"2026-07-28T21:41:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/c4e495fe5ff82c20aad4983c573e1c2ad1faa8d35309e38b101a81b0701c326b"}
{"level":"info","ts":"2026-07-28T21:41:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/5edae3419a4cc040d8f09ea257ca46439fc0ff0a765d34e872f40d6f6d65d1a8"}
{"level":"info","ts":"2026-07-28T21:41:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/f045dad595b8553b68978bf7b7a817e0672774bf1353f1f162bf452df461e394"}
{"level":"info","ts":"2026-07-28T21:41:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/2b2d11f3325097443572639ecb956eab8fc4f180992aca0d7197746a4d9cc17b"}
{"level":"info","ts":"2026-07-28T21:41:09Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/9defb191f02fe365075d3b9b3d24bf833aab8e3b264a300582202a99732f0397"}