{"level":"debug","ts":"2026-07-10T17:53:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"dc86d4eb3e6c27ce523044c464a4a97dc25617003b6e6159d41c6e6fd59a376f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T17:53:10Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T17:53:10Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T17:53:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"dc86d4eb3e6c27ce523044c464a4a97dc25617003b6e6159d41c6e6fd59a376f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T17:53:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4ad7bf3834477a5b4457de2c7edaf443b0d8a6295dc994df9977c29a5579ac57","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T17:53:10Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T17:53:10Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T17:53:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/dc86d4eb3e6c27ce523044c464a4a97dc25617003b6e6159d41c6e6fd59a376f"}
{"level":"info","ts":"2026-07-10T17:53:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4ad7bf3834477a5b4457de2c7edaf443b0d8a6295dc994df9977c29a5579ac57","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T17:53:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"dc86d4eb3e6c27ce523044c464a4a97dc25617003b6e6159d41c6e6fd59a376f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T17:53:10Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T17:53:10Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["dc86d4eb3e6c27ce523044c464a4a97dc25617003b6e6159d41c6e6fd59a376f"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T17:53:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4ad7bf3834477a5b4457de2c7edaf443b0d8a6295dc994df9977c29a5579ac57"}
{"level":"info","ts":"2026-07-10T17:53:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"dc86d4eb3e6c27ce523044c464a4a97dc25617003b6e6159d41c6e6fd59a376f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T17:53:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4ad7bf3834477a5b4457de2c7edaf443b0d8a6295dc994df9977c29a5579ac57","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T17:53:10Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T17:53:10Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["4ad7bf3834477a5b4457de2c7edaf443b0d8a6295dc994df9977c29a5579ac57"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T17:53:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4ad7bf3834477a5b4457de2c7edaf443b0d8a6295dc994df9977c29a5579ac57","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T17:53:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"dc86d4eb3e6c27ce523044c464a4a97dc25617003b6e6159d41c6e6fd59a376f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T17:53:10Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T17:53:10Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T17:53:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/dc86d4eb3e6c27ce523044c464a4a97dc25617003b6e6159d41c6e6fd59a376f"}
{"level":"info","ts":"2026-07-10T17:53:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"dc86d4eb3e6c27ce523044c464a4a97dc25617003b6e6159d41c6e6fd59a376f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T17:53:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4ad7bf3834477a5b4457de2c7edaf443b0d8a6295dc994df9977c29a5579ac57","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T17:53:10Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T17:53:10Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T17:53:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4ad7bf3834477a5b4457de2c7edaf443b0d8a6295dc994df9977c29a5579ac57","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T17:53:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"dc86d4eb3e6c27ce523044c464a4a97dc25617003b6e6159d41c6e6fd59a376f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T17:53:10Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T17:53:10Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["dc86d4eb3e6c27ce523044c464a4a97dc25617003b6e6159d41c6e6fd59a376f"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T17:53:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4ad7bf3834477a5b4457de2c7edaf443b0d8a6295dc994df9977c29a5579ac57"}
{"level":"info","ts":"2026-07-10T17:53:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"dc86d4eb3e6c27ce523044c464a4a97dc25617003b6e6159d41c6e6fd59a376f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T17:53:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4ad7bf3834477a5b4457de2c7edaf443b0d8a6295dc994df9977c29a5579ac57","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T17:53:10Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T17:53:10Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["4ad7bf3834477a5b4457de2c7edaf443b0d8a6295dc994df9977c29a5579ac57"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T17:53:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4ad7bf3834477a5b4457de2c7edaf443b0d8a6295dc994df9977c29a5579ac57","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T17:53:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"dc86d4eb3e6c27ce523044c464a4a97dc25617003b6e6159d41c6e6fd59a376f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T17:53:10Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T17:53:10Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T17:53:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/dc86d4eb3e6c27ce523044c464a4a97dc25617003b6e6159d41c6e6fd59a376f"}
{"level":"info","ts":"2026-07-10T17:53:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"dc86d4eb3e6c27ce523044c464a4a97dc25617003b6e6159d41c6e6fd59a376f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T17:53:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4ad7bf3834477a5b4457de2c7edaf443b0d8a6295dc994df9977c29a5579ac57","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T17:53:10Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T17:53:10Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T17:53:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4ad7bf3834477a5b4457de2c7edaf443b0d8a6295dc994df9977c29a5579ac57"}
{"level":"info","ts":"2026-07-10T17:53:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4ad7bf3834477a5b4457de2c7edaf443b0d8a6295dc994df9977c29a5579ac57","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T17:53:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a2cfe30bae599a13d0ad096e345c366977da54ed88fb54d09236260055fb59ab","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T17:53:10Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T17:53:10Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T17:53:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a2cfe30bae599a13d0ad096e345c366977da54ed88fb54d09236260055fb59ab","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T17:53:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"dc86d4eb3e6c27ce523044c464a4a97dc25617003b6e6159d41c6e6fd59a376f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T17:53:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1905c217ab456dd10b0bd365bd89ee8cab40b7a6b011c11e6f44a8bbea719840","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T17:53:10Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T17:53:10Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T17:53:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/dc86d4eb3e6c27ce523044c464a4a97dc25617003b6e6159d41c6e6fd59a376f"}
{"level":"info","ts":"2026-07-10T17:53:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1905c217ab456dd10b0bd365bd89ee8cab40b7a6b011c11e6f44a8bbea719840","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T17:53:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4ad7bf3834477a5b4457de2c7edaf443b0d8a6295dc994df9977c29a5579ac57","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T17:53:10Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T17:53:10Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["4ad7bf3834477a5b4457de2c7edaf443b0d8a6295dc994df9977c29a5579ac57"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T17:53:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4ad7bf3834477a5b4457de2c7edaf443b0d8a6295dc994df9977c29a5579ac57","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T17:53:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a2cfe30bae599a13d0ad096e345c366977da54ed88fb54d09236260055fb59ab","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T17:53:10Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T17:53:10Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T17:53:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a2cfe30bae599a13d0ad096e345c366977da54ed88fb54d09236260055fb59ab"}
{"level":"info","ts":"2026-07-10T17:53:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a2cfe30bae599a13d0ad096e345c366977da54ed88fb54d09236260055fb59ab","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T17:53:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"dc86d4eb3e6c27ce523044c464a4a97dc25617003b6e6159d41c6e6fd59a376f","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T17:53:10Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T17:53:10Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["dc86d4eb3e6c27ce523044c464a4a97dc25617003b6e6159d41c6e6fd59a376f"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T17:53:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1905c217ab456dd10b0bd365bd89ee8cab40b7a6b011c11e6f44a8bbea719840"}
{"level":"info","ts":"2026-07-10T17:53:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"dc86d4eb3e6c27ce523044c464a4a97dc25617003b6e6159d41c6e6fd59a376f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T17:53:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"1905c217ab456dd10b0bd365bd89ee8cab40b7a6b011c11e6f44a8bbea719840","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T17:53:10Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T17:53:10Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["1905c217ab456dd10b0bd365bd89ee8cab40b7a6b011c11e6f44a8bbea719840"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T17:53:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"1905c217ab456dd10b0bd365bd89ee8cab40b7a6b011c11e6f44a8bbea719840","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T17:53:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4ad7bf3834477a5b4457de2c7edaf443b0d8a6295dc994df9977c29a5579ac57","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T17:53:10Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T17:53:10Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T17:53:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4ad7bf3834477a5b4457de2c7edaf443b0d8a6295dc994df9977c29a5579ac57"}
{"level":"info","ts":"2026-07-10T17:53:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4ad7bf3834477a5b4457de2c7edaf443b0d8a6295dc994df9977c29a5579ac57","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T17:53:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a2cfe30bae599a13d0ad096e345c366977da54ed88fb54d09236260055fb59ab","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T17:53:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"dc86d4eb3e6c27ce523044c464a4a97dc25617003b6e6159d41c6e6fd59a376f","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T17:53:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1905c217ab456dd10b0bd365bd89ee8cab40b7a6b011c11e6f44a8bbea719840","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T17:53:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4ad7bf3834477a5b4457de2c7edaf443b0d8a6295dc994df9977c29a5579ac57","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T17:53:10Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T17:53:10Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["4ad7bf3834477a5b4457de2c7edaf443b0d8a6295dc994df9977c29a5579ac57"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T17:53:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a2cfe30bae599a13d0ad096e345c366977da54ed88fb54d09236260055fb59ab"}
{"level":"info","ts":"2026-07-10T17:53:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"4ad7bf3834477a5b4457de2c7edaf443b0d8a6295dc994df9977c29a5579ac57","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T17:53:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"4ad7bf3834477a5b4457de2c7edaf443b0d8a6295dc994df9977c29a5579ac57","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T17:53:10Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T17:53:10Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["4ad7bf3834477a5b4457de2c7edaf443b0d8a6295dc994df9977c29a5579ac57"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"error","ts":"2026-07-10T17:53:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"failed to update the resource","authconfig":{"name":"4ad7bf3834477a5b4457de2c7edaf443b0d8a6295dc994df9977c29a5579ac57","namespace":"kuadrant-system"},"error":"Operation cannot be fulfilled on authconfigs.authorino.kuadrant.io \"4ad7bf3834477a5b4457de2c7edaf443b0d8a6295dc994df9977c29a5579ac57\": the object has been modified; please apply your changes to the latest version and try again","stacktrace":"github.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).updateAuthConfigStatus\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:162\ngithub.com/kuadrant/authorino/controllers.(*AuthConfigStatusUpdater).Reconcile\n\t/usr/src/authorino/controllers/auth_config_status_updater.go:81\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:119\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:266\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2\n\t/opt/app-root/src/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.16.3/pkg/internal/controller/controller.go:227"}
{"level":"debug","ts":"2026-07-10T17:53:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4ad7bf3834477a5b4457de2c7edaf443b0d8a6295dc994df9977c29a5579ac57","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T17:53:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"a2cfe30bae599a13d0ad096e345c366977da54ed88fb54d09236260055fb59ab","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T17:53:10Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T17:53:10Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["a2cfe30bae599a13d0ad096e345c366977da54ed88fb54d09236260055fb59ab"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T17:53:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/dc86d4eb3e6c27ce523044c464a4a97dc25617003b6e6159d41c6e6fd59a376f"}
{"level":"info","ts":"2026-07-10T17:53:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"a2cfe30bae599a13d0ad096e345c366977da54ed88fb54d09236260055fb59ab","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T17:53:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4ad7bf3834477a5b4457de2c7edaf443b0d8a6295dc994df9977c29a5579ac57","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T17:53:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a2cfe30bae599a13d0ad096e345c366977da54ed88fb54d09236260055fb59ab","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T17:53:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1905c217ab456dd10b0bd365bd89ee8cab40b7a6b011c11e6f44a8bbea719840"}
{"level":"info","ts":"2026-07-10T17:53:10Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4ad7bf3834477a5b4457de2c7edaf443b0d8a6295dc994df9977c29a5579ac57"}
{"level":"debug","ts":"2026-07-10T17:53:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e3e13e8c2ce38b386a6ebd84a9b13ac6116c2efd89c4ae1d32220cb836c273b3","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T17:53:11Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T17:53:11Z","reason":"Unknown"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T17:53:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a2cfe30bae599a13d0ad096e345c366977da54ed88fb54d09236260055fb59ab"}
{"level":"info","ts":"2026-07-10T17:53:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e3e13e8c2ce38b386a6ebd84a9b13ac6116c2efd89c4ae1d32220cb836c273b3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T17:53:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e3e13e8c2ce38b386a6ebd84a9b13ac6116c2efd89c4ae1d32220cb836c273b3","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T17:53:11Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T17:53:11Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T17:53:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e3e13e8c2ce38b386a6ebd84a9b13ac6116c2efd89c4ae1d32220cb836c273b3"}
{"level":"info","ts":"2026-07-10T17:53:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e3e13e8c2ce38b386a6ebd84a9b13ac6116c2efd89c4ae1d32220cb836c273b3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T17:53:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e3e13e8c2ce38b386a6ebd84a9b13ac6116c2efd89c4ae1d32220cb836c273b3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T17:53:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e3e13e8c2ce38b386a6ebd84a9b13ac6116c2efd89c4ae1d32220cb836c273b3","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T17:53:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e3e13e8c2ce38b386a6ebd84a9b13ac6116c2efd89c4ae1d32220cb836c273b3"}
{"level":"debug","ts":"2026-07-10T17:53:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e3e13e8c2ce38b386a6ebd84a9b13ac6116c2efd89c4ae1d32220cb836c273b3","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T17:53:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e3e13e8c2ce38b386a6ebd84a9b13ac6116c2efd89c4ae1d32220cb836c273b3"}
{"level":"debug","ts":"2026-07-10T17:53:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e3e13e8c2ce38b386a6ebd84a9b13ac6116c2efd89c4ae1d32220cb836c273b3","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T17:53:11Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T17:53:11Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["e3e13e8c2ce38b386a6ebd84a9b13ac6116c2efd89c4ae1d32220cb836c273b3"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T17:53:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e3e13e8c2ce38b386a6ebd84a9b13ac6116c2efd89c4ae1d32220cb836c273b3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T17:53:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"fb71d1587e27ceb11f9102fbb315326986aa1be57c7dd3d04bc4e7f414fe907e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T17:53:11Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T17:53:11Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T17:53:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"fb71d1587e27ceb11f9102fbb315326986aa1be57c7dd3d04bc4e7f414fe907e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T17:53:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e3e13e8c2ce38b386a6ebd84a9b13ac6116c2efd89c4ae1d32220cb836c273b3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T17:53:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"fb71d1587e27ceb11f9102fbb315326986aa1be57c7dd3d04bc4e7f414fe907e","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T17:53:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/fb71d1587e27ceb11f9102fbb315326986aa1be57c7dd3d04bc4e7f414fe907e"}
{"level":"debug","ts":"2026-07-10T17:53:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"fb71d1587e27ceb11f9102fbb315326986aa1be57c7dd3d04bc4e7f414fe907e","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T17:53:11Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T17:53:11Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["fb71d1587e27ceb11f9102fbb315326986aa1be57c7dd3d04bc4e7f414fe907e"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T17:53:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"fb71d1587e27ceb11f9102fbb315326986aa1be57c7dd3d04bc4e7f414fe907e","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T17:53:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"fb71d1587e27ceb11f9102fbb315326986aa1be57c7dd3d04bc4e7f414fe907e","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T17:53:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e3e13e8c2ce38b386a6ebd84a9b13ac6116c2efd89c4ae1d32220cb836c273b3"}
{"level":"info","ts":"2026-07-10T17:53:11Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/fb71d1587e27ceb11f9102fbb315326986aa1be57c7dd3d04bc4e7f414fe907e"}
{"level":"debug","ts":"2026-07-10T17:53:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"8a9fe50b37dea316e9925c164c4d3e667cbe4c31fd1d4fd04eafb79c4edbfa96","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T17:53:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/8a9fe50b37dea316e9925c164c4d3e667cbe4c31fd1d4fd04eafb79c4edbfa96"}
{"level":"debug","ts":"2026-07-10T17:53:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e49d1830106dd17774362b919fc87393cdd06130726a1a2b6b4a51ff564d4161","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T17:53:25Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T17:53:25Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T17:53:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e49d1830106dd17774362b919fc87393cdd06130726a1a2b6b4a51ff564d4161","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T17:53:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e49d1830106dd17774362b919fc87393cdd06130726a1a2b6b4a51ff564d4161","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T17:53:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e49d1830106dd17774362b919fc87393cdd06130726a1a2b6b4a51ff564d4161","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T17:53:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e49d1830106dd17774362b919fc87393cdd06130726a1a2b6b4a51ff564d4161"}
{"level":"debug","ts":"2026-07-10T17:53:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e49d1830106dd17774362b919fc87393cdd06130726a1a2b6b4a51ff564d4161","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T17:53:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e49d1830106dd17774362b919fc87393cdd06130726a1a2b6b4a51ff564d4161"}
{"level":"debug","ts":"2026-07-10T17:53:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e49d1830106dd17774362b919fc87393cdd06130726a1a2b6b4a51ff564d4161","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T17:53:25Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T17:53:25Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["e49d1830106dd17774362b919fc87393cdd06130726a1a2b6b4a51ff564d4161"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T17:53:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e49d1830106dd17774362b919fc87393cdd06130726a1a2b6b4a51ff564d4161","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T17:53:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e49d1830106dd17774362b919fc87393cdd06130726a1a2b6b4a51ff564d4161","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T17:53:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"70bff0f96baae2143676d9c0fc28581532add8ec5b2d3900596699566d13afb8","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T17:53:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e49d1830106dd17774362b919fc87393cdd06130726a1a2b6b4a51ff564d4161"}
{"level":"info","ts":"2026-07-10T17:53:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/70bff0f96baae2143676d9c0fc28581532add8ec5b2d3900596699566d13afb8"}
{"level":"debug","ts":"2026-07-10T17:53:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"48352ac43f93a0ef720e4dbc0544cea25c7523c3bcb5ee74ace8ad736a96a4fc","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T17:53:25Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T17:53:25Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T17:53:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"48352ac43f93a0ef720e4dbc0544cea25c7523c3bcb5ee74ace8ad736a96a4fc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T17:53:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"48352ac43f93a0ef720e4dbc0544cea25c7523c3bcb5ee74ace8ad736a96a4fc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T17:53:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"22569a450059b7b16efd9e0bdfedf5edb095432e6276bcc2a73681e0c8a2c2bc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T17:53:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"48352ac43f93a0ef720e4dbc0544cea25c7523c3bcb5ee74ace8ad736a96a4fc","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T17:53:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/48352ac43f93a0ef720e4dbc0544cea25c7523c3bcb5ee74ace8ad736a96a4fc"}
{"level":"debug","ts":"2026-07-10T17:53:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"48352ac43f93a0ef720e4dbc0544cea25c7523c3bcb5ee74ace8ad736a96a4fc","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T17:53:25Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T17:53:25Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["48352ac43f93a0ef720e4dbc0544cea25c7523c3bcb5ee74ace8ad736a96a4fc"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T17:53:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/22569a450059b7b16efd9e0bdfedf5edb095432e6276bcc2a73681e0c8a2c2bc"}
{"level":"info","ts":"2026-07-10T17:53:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"48352ac43f93a0ef720e4dbc0544cea25c7523c3bcb5ee74ace8ad736a96a4fc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T17:53:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"48352ac43f93a0ef720e4dbc0544cea25c7523c3bcb5ee74ace8ad736a96a4fc","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T17:53:25Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T17:53:25Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T17:53:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"48352ac43f93a0ef720e4dbc0544cea25c7523c3bcb5ee74ace8ad736a96a4fc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T17:53:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"48352ac43f93a0ef720e4dbc0544cea25c7523c3bcb5ee74ace8ad736a96a4fc","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T17:53:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/48352ac43f93a0ef720e4dbc0544cea25c7523c3bcb5ee74ace8ad736a96a4fc"}
{"level":"debug","ts":"2026-07-10T17:53:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"48352ac43f93a0ef720e4dbc0544cea25c7523c3bcb5ee74ace8ad736a96a4fc","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T17:53:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/48352ac43f93a0ef720e4dbc0544cea25c7523c3bcb5ee74ace8ad736a96a4fc"}
{"level":"debug","ts":"2026-07-10T17:53:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"48352ac43f93a0ef720e4dbc0544cea25c7523c3bcb5ee74ace8ad736a96a4fc","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T17:53:25Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T17:53:25Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["48352ac43f93a0ef720e4dbc0544cea25c7523c3bcb5ee74ace8ad736a96a4fc"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T17:53:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"48352ac43f93a0ef720e4dbc0544cea25c7523c3bcb5ee74ace8ad736a96a4fc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T17:53:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"48352ac43f93a0ef720e4dbc0544cea25c7523c3bcb5ee74ace8ad736a96a4fc","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T17:53:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"666c4064c80564b3583c630ddfa3ef5454d5ff954237f54e34a346468143ba9c","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T17:53:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/48352ac43f93a0ef720e4dbc0544cea25c7523c3bcb5ee74ace8ad736a96a4fc"}
{"level":"info","ts":"2026-07-10T17:53:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/666c4064c80564b3583c630ddfa3ef5454d5ff954237f54e34a346468143ba9c"}
{"level":"debug","ts":"2026-07-10T17:53:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e5c6eb70c7280da1101ed31a75d81a4c1fd9ef8a688f373be71a4b780da1a137","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T17:53:25Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T17:53:25Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T17:53:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e5c6eb70c7280da1101ed31a75d81a4c1fd9ef8a688f373be71a4b780da1a137","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T17:53:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e5c6eb70c7280da1101ed31a75d81a4c1fd9ef8a688f373be71a4b780da1a137","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T17:53:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e5c6eb70c7280da1101ed31a75d81a4c1fd9ef8a688f373be71a4b780da1a137","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T17:53:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e5c6eb70c7280da1101ed31a75d81a4c1fd9ef8a688f373be71a4b780da1a137"}
{"level":"debug","ts":"2026-07-10T17:53:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e5c6eb70c7280da1101ed31a75d81a4c1fd9ef8a688f373be71a4b780da1a137","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T17:53:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e5c6eb70c7280da1101ed31a75d81a4c1fd9ef8a688f373be71a4b780da1a137"}
{"level":"debug","ts":"2026-07-10T17:53:25Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e5c6eb70c7280da1101ed31a75d81a4c1fd9ef8a688f373be71a4b780da1a137","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T17:53:25Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T17:53:25Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["e5c6eb70c7280da1101ed31a75d81a4c1fd9ef8a688f373be71a4b780da1a137"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T17:53:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e5c6eb70c7280da1101ed31a75d81a4c1fd9ef8a688f373be71a4b780da1a137","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T17:53:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e5c6eb70c7280da1101ed31a75d81a4c1fd9ef8a688f373be71a4b780da1a137","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"False","lastTransitionTime":"2026-07-10T17:53:26Z","reason":"HostsNotLinked","message":"No hosts linked to the resource"},{"type":"Ready","status":"False","lastTransitionTime":"2026-07-10T17:53:26Z","reason":"Reconciling"}],"summary":{"ready":false,"hostsReady":[],"numHostsReady":"0/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T17:53:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e5c6eb70c7280da1101ed31a75d81a4c1fd9ef8a688f373be71a4b780da1a137","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T17:53:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"b3740e7770f63b03b610e0dd41cbb1c50227bdc414eeb9954e03ed2c328af67b","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T17:53:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e5c6eb70c7280da1101ed31a75d81a4c1fd9ef8a688f373be71a4b780da1a137","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T17:53:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e5c6eb70c7280da1101ed31a75d81a4c1fd9ef8a688f373be71a4b780da1a137","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T17:53:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"dc86d4eb3e6c27ce523044c464a4a97dc25617003b6e6159d41c6e6fd59a376f","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T17:53:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e5c6eb70c7280da1101ed31a75d81a4c1fd9ef8a688f373be71a4b780da1a137"}
{"level":"debug","ts":"2026-07-10T17:53:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"44986b74e95212f14a87fab3f97ef169d106d7c35ffa23704b9149693f3efbda","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T17:53:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status changed","authconfig":{"name":"e5c6eb70c7280da1101ed31a75d81a4c1fd9ef8a688f373be71a4b780da1a137","namespace":"kuadrant-system"},"authconfig/status":{"conditions":[{"type":"Available","status":"True","lastTransitionTime":"2026-07-10T17:53:26Z","reason":"HostsLinked"},{"type":"Ready","status":"True","lastTransitionTime":"2026-07-10T17:53:26Z","reason":"Reconciled"}],"summary":{"ready":true,"hostsReady":["e5c6eb70c7280da1101ed31a75d81a4c1fd9ef8a688f373be71a4b780da1a137"],"numHostsReady":"1/1","numIdentitySources":2,"numMetadataSources":2,"numAuthorizationPolicies":4,"numResponseItems":6,"festivalWristbandEnabled":false}}}
{"level":"info","ts":"2026-07-10T17:53:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/b3740e7770f63b03b610e0dd41cbb1c50227bdc414eeb9954e03ed2c328af67b"}
{"level":"info","ts":"2026-07-10T17:53:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status updated","authconfig":{"name":"e5c6eb70c7280da1101ed31a75d81a4c1fd9ef8a688f373be71a4b780da1a137","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T17:53:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e5c6eb70c7280da1101ed31a75d81a4c1fd9ef8a688f373be71a4b780da1a137","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T17:53:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/dc86d4eb3e6c27ce523044c464a4a97dc25617003b6e6159d41c6e6fd59a376f"}
{"level":"info","ts":"2026-07-10T17:53:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e5c6eb70c7280da1101ed31a75d81a4c1fd9ef8a688f373be71a4b780da1a137"}
{"level":"debug","ts":"2026-07-10T17:53:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5edeb67e7d0909164ff56c952351e057cfdfef4b061a04ca491f655af38c6fc4","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T17:53:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/44986b74e95212f14a87fab3f97ef169d106d7c35ffa23704b9149693f3efbda"}
{"level":"debug","ts":"2026-07-10T17:53:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a2cfe30bae599a13d0ad096e345c366977da54ed88fb54d09236260055fb59ab","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T17:53:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5edeb67e7d0909164ff56c952351e057cfdfef4b061a04ca491f655af38c6fc4"}
{"level":"debug","ts":"2026-07-10T17:53:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"88d5b0f8219c3483206029353819f9a541082a6720ced97055f2fc2c8da7b251","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T17:53:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"032b5f778367eb8a741f28a4f0de918770745d9bc96ad50f03d5cdc66414d68e","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T17:53:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a2cfe30bae599a13d0ad096e345c366977da54ed88fb54d09236260055fb59ab"}
{"level":"debug","ts":"2026-07-10T17:53:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"d1ee3352ba8335d3da2b6a9bec659c561d4e18ce5a9de62e196fbe1d09f2ff85","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T17:53:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/88d5b0f8219c3483206029353819f9a541082a6720ced97055f2fc2c8da7b251"}
{"level":"debug","ts":"2026-07-10T17:53:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"2a49dfabf9dd2b940273e48365e5786445f6a2ae42d60ab6b5a96f59a669d36a","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T17:53:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/032b5f778367eb8a741f28a4f0de918770745d9bc96ad50f03d5cdc66414d68e"}
{"level":"debug","ts":"2026-07-10T17:53:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"a72d19fb1df7be5dbd254fd3096b7419b973a8ef93faba0996992afa292a7d81","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T17:53:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/d1ee3352ba8335d3da2b6a9bec659c561d4e18ce5a9de62e196fbe1d09f2ff85"}
{"level":"debug","ts":"2026-07-10T17:53:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"32f8bb12835c4547c09efd571f14bed6f00808f58c9721b3dcb758a8fa6c6de5","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T17:53:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"fb71d1587e27ceb11f9102fbb315326986aa1be57c7dd3d04bc4e7f414fe907e","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T17:53:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/2a49dfabf9dd2b940273e48365e5786445f6a2ae42d60ab6b5a96f59a669d36a"}
{"level":"debug","ts":"2026-07-10T17:53:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"5fe5cfe714cee1f160623c0fcfc7d499cb3269534ec8423d716891443ee95caa","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T17:53:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/a72d19fb1df7be5dbd254fd3096b7419b973a8ef93faba0996992afa292a7d81"}
{"level":"debug","ts":"2026-07-10T17:53:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"e3e13e8c2ce38b386a6ebd84a9b13ac6116c2efd89c4ae1d32220cb836c273b3","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T17:53:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"1905c217ab456dd10b0bd365bd89ee8cab40b7a6b011c11e6f44a8bbea719840","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T17:53:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/32f8bb12835c4547c09efd571f14bed6f00808f58c9721b3dcb758a8fa6c6de5"}
{"level":"info","ts":"2026-07-10T17:53:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/fb71d1587e27ceb11f9102fbb315326986aa1be57c7dd3d04bc4e7f414fe907e"}
{"level":"debug","ts":"2026-07-10T17:53:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"4ad7bf3834477a5b4457de2c7edaf443b0d8a6295dc994df9977c29a5579ac57","namespace":"kuadrant-system"}}
{"level":"debug","ts":"2026-07-10T17:53:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig.statusupdater","msg":"resource status did not change","authconfig":{"name":"c113bb4c59a7cb1d16bedc1f3326168b08faf9592dad1f285beeb24ebd7f7521","namespace":"kuadrant-system"}}
{"level":"info","ts":"2026-07-10T17:53:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/5fe5cfe714cee1f160623c0fcfc7d499cb3269534ec8423d716891443ee95caa"}
{"level":"info","ts":"2026-07-10T17:53:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/e3e13e8c2ce38b386a6ebd84a9b13ac6116c2efd89c4ae1d32220cb836c273b3"}
{"level":"info","ts":"2026-07-10T17:53:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/1905c217ab456dd10b0bd365bd89ee8cab40b7a6b011c11e6f44a8bbea719840"}
{"level":"info","ts":"2026-07-10T17:53:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/4ad7bf3834477a5b4457de2c7edaf443b0d8a6295dc994df9977c29a5579ac57"}
{"level":"info","ts":"2026-07-10T17:53:26Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource reconciled","authconfig":"kuadrant-system/c113bb4c59a7cb1d16bedc1f3326168b08faf9592dad1f285beeb24ebd7f7521"}
{"level":"info","ts":"2026-07-10T17:53:27Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1fecbcc2-9243-40bf-9561-421fc84a4d6e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.18:47914","PortSpecifier":{"PortValue":47914}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.58:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"1fecbcc2-9243-40bf-9561-421fc84a4d6e","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-3beb3b.apps.c2229a72-d6cf-469e-9ffe-bddae96f0fc5.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T17:53:27Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"1fecbcc2-9243-40bf-9561-421fc84a4d6e","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.18:47914","PortSpecifier":{"PortValue":47914}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.58:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783706007,"nanos":816664220},"http":{"id":"1fecbcc2-9243-40bf-9561-421fc84a4d6e","method":"POST","headers":{":authority":"e2e-shared-a-3beb3b.apps.c2229a72-d6cf-469e-9ffe-bddae96f0fc5.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T17:53:27Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"1fecbcc2-9243-40bf-9561-421fc84a4d6e","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-10T17:53:27Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"1fecbcc2-9243-40bf-9561-421fc84a4d6e","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"3e01e4b4-81fa-44f6-acfe-5e63bab66066","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=7eaac46e-c3e2-4f3a-8cb3-07e472cf6884"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/bddae96f0fc5"]}}
{"level":"debug","ts":"2026-07-10T17:53:27Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"1fecbcc2-9243-40bf-9561-421fc84a4d6e","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/bddae96f0fc5"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=7eaac46e-c3e2-4f3a-8cb3-07e472cf6884"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"3e01e4b4-81fa-44f6-acfe-5e63bab66066","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"5fe5cfe714cee1f160623c0fcfc7d499cb3269534ec8423d716891443ee95caa"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.58:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-3beb3b.apps.c2229a72-d6cf-469e-9ffe-bddae96f0fc5.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T17:53:27Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1fecbcc2-9243-40bf-9561-421fc84a4d6e","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T17:53:27Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1fecbcc2-9243-40bf-9561-421fc84a4d6e","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T17:53:27Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"1fecbcc2-9243-40bf-9561-421fc84a4d6e","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-3beb3b/rate-test-model-3beb3b\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T17:53:27Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"1fecbcc2-9243-40bf-9561-421fc84a4d6e","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-10T17:53:27Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1fecbcc2-9243-40bf-9561-421fc84a4d6e","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T17:53:27Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"1fecbcc2-9243-40bf-9561-421fc84a4d6e","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-10T17:53:27Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1fecbcc2-9243-40bf-9561-421fc84a4d6e","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T17:53:27Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"1fecbcc2-9243-40bf-9561-421fc84a4d6e","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T17:53:27Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"daece325-a447-436b-8196-7e29f4cf5dc1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.18:44012","PortSpecifier":{"PortValue":44012}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.64:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"daece325-a447-436b-8196-7e29f4cf5dc1","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-9f66f0.apps.c2229a72-d6cf-469e-9ffe-bddae96f0fc5.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T17:53:27Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"daece325-a447-436b-8196-7e29f4cf5dc1","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.18:44012","PortSpecifier":{"PortValue":44012}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.64:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783706007,"nanos":853499298},"http":{"id":"daece325-a447-436b-8196-7e29f4cf5dc1","method":"POST","headers":{":authority":"e2e-shared-b-9f66f0.apps.c2229a72-d6cf-469e-9ffe-bddae96f0fc5.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T17:53:27Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"daece325-a447-436b-8196-7e29f4cf5dc1","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-10T17:53:27Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"daece325-a447-436b-8196-7e29f4cf5dc1","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"3e01e4b4-81fa-44f6-acfe-5e63bab66066","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=7eaac46e-c3e2-4f3a-8cb3-07e472cf6884"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/bddae96f0fc5"]}}
{"level":"debug","ts":"2026-07-10T17:53:27Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"daece325-a447-436b-8196-7e29f4cf5dc1","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/bddae96f0fc5"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=7eaac46e-c3e2-4f3a-8cb3-07e472cf6884"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"3e01e4b4-81fa-44f6-acfe-5e63bab66066","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"32f8bb12835c4547c09efd571f14bed6f00808f58c9721b3dcb758a8fa6c6de5"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.64:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-9f66f0.apps.c2229a72-d6cf-469e-9ffe-bddae96f0fc5.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T17:53:27Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"daece325-a447-436b-8196-7e29f4cf5dc1","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T17:53:27Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"daece325-a447-436b-8196-7e29f4cf5dc1","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T17:53:27Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"daece325-a447-436b-8196-7e29f4cf5dc1","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-9f66f0/rate-test-model-9f66f0\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T17:53:27Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"daece325-a447-436b-8196-7e29f4cf5dc1","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-10T17:53:27Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"daece325-a447-436b-8196-7e29f4cf5dc1","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T17:53:27Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"daece325-a447-436b-8196-7e29f4cf5dc1","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-10T17:53:27Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"daece325-a447-436b-8196-7e29f4cf5dc1","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T17:53:27Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"daece325-a447-436b-8196-7e29f4cf5dc1","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T17:53:27Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"fd948b3f-b7cc-4d09-b6fd-34fcdc7a51f8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.18:47926","PortSpecifier":{"PortValue":47926}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.58:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"fd948b3f-b7cc-4d09-b6fd-34fcdc7a51f8","method":"POST","path":"/ai-tenant-e2e-shared-a-3beb3b/rate-test-model-3beb3b/v1/completions","host":"e2e-shared-a-3beb3b.apps.c2229a72-d6cf-469e-9ffe-bddae96f0fc5.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T17:53:27Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"fd948b3f-b7cc-4d09-b6fd-34fcdc7a51f8","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.18:47926","PortSpecifier":{"PortValue":47926}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.58:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783706007,"nanos":897311371},"http":{"id":"fd948b3f-b7cc-4d09-b6fd-34fcdc7a51f8","method":"POST","headers":{":authority":"e2e-shared-a-3beb3b.apps.c2229a72-d6cf-469e-9ffe-bddae96f0fc5.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-3beb3b/rate-test-model-3beb3b/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T17:53:27Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"fd948b3f-b7cc-4d09-b6fd-34fcdc7a51f8","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-acTrTVgghkp6KewC_tjROQ5dLddUPhjUYniW3uDZvrA8A0zNtmlUlPCo9UV8"}
{"level":"debug","ts":"2026-07-10T17:53:27Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"fd948b3f-b7cc-4d09-b6fd-34fcdc7a51f8","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-3beb3b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-acTrTVgghkp6KewC_tjROQ5dLddUPhjUYniW3uDZvrA8A0zNtmlUlPCo9UV8\"}"}
{"level":"debug","ts":"2026-07-10T17:53:27Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"fd948b3f-b7cc-4d09-b6fd-34fcdc7a51f8","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-3beb3b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"26ea2a09-f24c-4f35-b470-d69b83ed90df","keyName":"e2e-rate-a-3f3ed4","subscription":"e2e-rate-iso-a-3f3ed4","tenant":"e2e-shared-a-3beb3b","userId":"26ea2a09-f24c-4f35-b470-d69b83ed90df","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T17:53:27Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"fd948b3f-b7cc-4d09-b6fd-34fcdc7a51f8","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-3beb3b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-3beb3b/rate-test-model-3beb3b\",\"requestedSubscription\":\"e2e-rate-iso-a-3f3ed4\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-10T17:53:27Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"fd948b3f-b7cc-4d09-b6fd-34fcdc7a51f8","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-3beb3b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-3beb3b","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-3f3ed4","namespace":"ai-tenant-e2e-shared-a-3beb3b","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-10T17:53:27Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"fd948b3f-b7cc-4d09-b6fd-34fcdc7a51f8","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T17:53:27Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fd948b3f-b7cc-4d09-b6fd-34fcdc7a51f8","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T17:53:27Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fd948b3f-b7cc-4d09-b6fd-34fcdc7a51f8","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T17:53:27Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fd948b3f-b7cc-4d09-b6fd-34fcdc7a51f8","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T17:53:27Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"fd948b3f-b7cc-4d09-b6fd-34fcdc7a51f8","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-3beb3b/rate-test-model-3beb3b\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T17:53:27Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"fd948b3f-b7cc-4d09-b6fd-34fcdc7a51f8","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T17:53:27Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"fd948b3f-b7cc-4d09-b6fd-34fcdc7a51f8","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-3f3ed4"}
{"level":"debug","ts":"2026-07-10T17:53:27Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"fd948b3f-b7cc-4d09-b6fd-34fcdc7a51f8","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T17:53:27Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"fd948b3f-b7cc-4d09-b6fd-34fcdc7a51f8","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"26ea2a09-f24c-4f35-b470-d69b83ed90df","keyName":"e2e-rate-a-3f3ed4","selected_subscription":"e2e-rate-iso-a-3f3ed4","selected_subscription_key":"ai-tenant-e2e-shared-a-3beb3b/e2e-rate-iso-a-3f3ed4@ai-tenant-e2e-shared-a-3beb3b/rate-test-model-3beb3b","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-3beb3b","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-3f3ed4","namespace":"ai-tenant-e2e-shared-a-3beb3b","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-10T17:53:27Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"fd948b3f-b7cc-4d09-b6fd-34fcdc7a51f8","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T17:53:27Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"fd948b3f-b7cc-4d09-b6fd-34fcdc7a51f8","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T17:53:28Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"4083b7cc-f1da-407c-87c1-6bed68778af4","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.18:47930","PortSpecifier":{"PortValue":47930}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.58:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"4083b7cc-f1da-407c-87c1-6bed68778af4","method":"POST","path":"/ai-tenant-e2e-shared-a-3beb3b/rate-test-model-3beb3b/v1/completions","host":"e2e-shared-a-3beb3b.apps.c2229a72-d6cf-469e-9ffe-bddae96f0fc5.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T17:53:28Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"4083b7cc-f1da-407c-87c1-6bed68778af4","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.18:47930","PortSpecifier":{"PortValue":47930}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.58:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783706008,"nanos":980565144},"http":{"id":"4083b7cc-f1da-407c-87c1-6bed68778af4","method":"POST","headers":{":authority":"e2e-shared-a-3beb3b.apps.c2229a72-d6cf-469e-9ffe-bddae96f0fc5.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-3beb3b/rate-test-model-3beb3b/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T17:53:28Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"4083b7cc-f1da-407c-87c1-6bed68778af4","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-acTrTVgghkp6KewC_tjROQ5dLddUPhjUYniW3uDZvrA8A0zNtmlUlPCo9UV8"}
{"level":"debug","ts":"2026-07-10T17:53:28Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"4083b7cc-f1da-407c-87c1-6bed68778af4","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-3beb3b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-acTrTVgghkp6KewC_tjROQ5dLddUPhjUYniW3uDZvrA8A0zNtmlUlPCo9UV8\"}"}
{"level":"debug","ts":"2026-07-10T17:53:28Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"4083b7cc-f1da-407c-87c1-6bed68778af4","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-3beb3b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"26ea2a09-f24c-4f35-b470-d69b83ed90df","keyName":"e2e-rate-a-3f3ed4","subscription":"e2e-rate-iso-a-3f3ed4","tenant":"e2e-shared-a-3beb3b","userId":"26ea2a09-f24c-4f35-b470-d69b83ed90df","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T17:53:28Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"4083b7cc-f1da-407c-87c1-6bed68778af4","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-3beb3b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-3beb3b/rate-test-model-3beb3b\",\"requestedSubscription\":\"e2e-rate-iso-a-3f3ed4\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-10T17:53:28Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"4083b7cc-f1da-407c-87c1-6bed68778af4","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-3beb3b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-3beb3b","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-3f3ed4","namespace":"ai-tenant-e2e-shared-a-3beb3b","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-10T17:53:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"4083b7cc-f1da-407c-87c1-6bed68778af4","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T17:53:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4083b7cc-f1da-407c-87c1-6bed68778af4","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T17:53:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4083b7cc-f1da-407c-87c1-6bed68778af4","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T17:53:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4083b7cc-f1da-407c-87c1-6bed68778af4","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T17:53:28Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"4083b7cc-f1da-407c-87c1-6bed68778af4","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-3beb3b/rate-test-model-3beb3b\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T17:53:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4083b7cc-f1da-407c-87c1-6bed68778af4","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T17:53:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4083b7cc-f1da-407c-87c1-6bed68778af4","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-3f3ed4"}
{"level":"debug","ts":"2026-07-10T17:53:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4083b7cc-f1da-407c-87c1-6bed68778af4","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T17:53:28Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"4083b7cc-f1da-407c-87c1-6bed68778af4","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"26ea2a09-f24c-4f35-b470-d69b83ed90df","keyName":"e2e-rate-a-3f3ed4","selected_subscription":"e2e-rate-iso-a-3f3ed4","selected_subscription_key":"ai-tenant-e2e-shared-a-3beb3b/e2e-rate-iso-a-3f3ed4@ai-tenant-e2e-shared-a-3beb3b/rate-test-model-3beb3b","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-3beb3b","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-3f3ed4","namespace":"ai-tenant-e2e-shared-a-3beb3b","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-10T17:53:28Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4083b7cc-f1da-407c-87c1-6bed68778af4","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T17:53:28Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"4083b7cc-f1da-407c-87c1-6bed68778af4","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T17:53:30Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a7672cb4-f2bc-4c19-85f1-5c29181b57da","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.18:47934","PortSpecifier":{"PortValue":47934}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.58:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"a7672cb4-f2bc-4c19-85f1-5c29181b57da","method":"POST","path":"/ai-tenant-e2e-shared-a-3beb3b/rate-test-model-3beb3b/v1/completions","host":"e2e-shared-a-3beb3b.apps.c2229a72-d6cf-469e-9ffe-bddae96f0fc5.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T17:53:30Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a7672cb4-f2bc-4c19-85f1-5c29181b57da","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.18:47934","PortSpecifier":{"PortValue":47934}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.58:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783706010,"nanos":22742221},"http":{"id":"a7672cb4-f2bc-4c19-85f1-5c29181b57da","method":"POST","headers":{":authority":"e2e-shared-a-3beb3b.apps.c2229a72-d6cf-469e-9ffe-bddae96f0fc5.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-3beb3b/rate-test-model-3beb3b/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T17:53:30Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"a7672cb4-f2bc-4c19-85f1-5c29181b57da","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-acTrTVgghkp6KewC_tjROQ5dLddUPhjUYniW3uDZvrA8A0zNtmlUlPCo9UV8"}
{"level":"debug","ts":"2026-07-10T17:53:30Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a7672cb4-f2bc-4c19-85f1-5c29181b57da","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-3beb3b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-acTrTVgghkp6KewC_tjROQ5dLddUPhjUYniW3uDZvrA8A0zNtmlUlPCo9UV8\"}"}
{"level":"debug","ts":"2026-07-10T17:53:30Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a7672cb4-f2bc-4c19-85f1-5c29181b57da","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-3beb3b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"26ea2a09-f24c-4f35-b470-d69b83ed90df","keyName":"e2e-rate-a-3f3ed4","subscription":"e2e-rate-iso-a-3f3ed4","tenant":"e2e-shared-a-3beb3b","userId":"26ea2a09-f24c-4f35-b470-d69b83ed90df","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T17:53:30Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a7672cb4-f2bc-4c19-85f1-5c29181b57da","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-3beb3b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-3beb3b/rate-test-model-3beb3b\",\"requestedSubscription\":\"e2e-rate-iso-a-3f3ed4\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-10T17:53:30Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a7672cb4-f2bc-4c19-85f1-5c29181b57da","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-3beb3b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-3beb3b","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-3f3ed4","namespace":"ai-tenant-e2e-shared-a-3beb3b","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-10T17:53:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"a7672cb4-f2bc-4c19-85f1-5c29181b57da","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T17:53:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a7672cb4-f2bc-4c19-85f1-5c29181b57da","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T17:53:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a7672cb4-f2bc-4c19-85f1-5c29181b57da","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T17:53:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a7672cb4-f2bc-4c19-85f1-5c29181b57da","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T17:53:30Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a7672cb4-f2bc-4c19-85f1-5c29181b57da","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-3beb3b/rate-test-model-3beb3b\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T17:53:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a7672cb4-f2bc-4c19-85f1-5c29181b57da","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T17:53:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a7672cb4-f2bc-4c19-85f1-5c29181b57da","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-3f3ed4"}
{"level":"debug","ts":"2026-07-10T17:53:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a7672cb4-f2bc-4c19-85f1-5c29181b57da","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T17:53:30Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a7672cb4-f2bc-4c19-85f1-5c29181b57da","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"26ea2a09-f24c-4f35-b470-d69b83ed90df","keyName":"e2e-rate-a-3f3ed4","selected_subscription":"e2e-rate-iso-a-3f3ed4","selected_subscription_key":"ai-tenant-e2e-shared-a-3beb3b/e2e-rate-iso-a-3f3ed4@ai-tenant-e2e-shared-a-3beb3b/rate-test-model-3beb3b","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-3beb3b","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-3f3ed4","namespace":"ai-tenant-e2e-shared-a-3beb3b","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-10T17:53:30Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a7672cb4-f2bc-4c19-85f1-5c29181b57da","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T17:53:30Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a7672cb4-f2bc-4c19-85f1-5c29181b57da","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T17:53:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d6a8a4ee-c346-47b2-8011-fc9c1614b510","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.18:59168","PortSpecifier":{"PortValue":59168}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.58:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"d6a8a4ee-c346-47b2-8011-fc9c1614b510","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-a-3beb3b.apps.c2229a72-d6cf-469e-9ffe-bddae96f0fc5.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T17:53:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"d6a8a4ee-c346-47b2-8011-fc9c1614b510","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.18:59168","PortSpecifier":{"PortValue":59168}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.58:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783706018,"nanos":589826949},"http":{"id":"d6a8a4ee-c346-47b2-8011-fc9c1614b510","method":"POST","headers":{":authority":"e2e-shared-a-3beb3b.apps.c2229a72-d6cf-469e-9ffe-bddae96f0fc5.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T17:53:38Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"d6a8a4ee-c346-47b2-8011-fc9c1614b510","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-10T17:53:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"d6a8a4ee-c346-47b2-8011-fc9c1614b510","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"3e01e4b4-81fa-44f6-acfe-5e63bab66066","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=7eaac46e-c3e2-4f3a-8cb3-07e472cf6884"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/bddae96f0fc5"]}}
{"level":"debug","ts":"2026-07-10T17:53:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"d6a8a4ee-c346-47b2-8011-fc9c1614b510","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/bddae96f0fc5"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=7eaac46e-c3e2-4f3a-8cb3-07e472cf6884"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"3e01e4b4-81fa-44f6-acfe-5e63bab66066","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"5fe5cfe714cee1f160623c0fcfc7d499cb3269534ec8423d716891443ee95caa"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.132.0.58:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-a-3beb3b.apps.c2229a72-d6cf-469e-9ffe-bddae96f0fc5.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T17:53:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d6a8a4ee-c346-47b2-8011-fc9c1614b510","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T17:53:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d6a8a4ee-c346-47b2-8011-fc9c1614b510","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T17:53:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"d6a8a4ee-c346-47b2-8011-fc9c1614b510","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-3beb3b/rate-test-model-3beb3b\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T17:53:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"d6a8a4ee-c346-47b2-8011-fc9c1614b510","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"subscription_info","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"userid","Value":{}},{"Name":"keyId","Value":{}},{"Name":"selected_subscription","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-10T17:53:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d6a8a4ee-c346-47b2-8011-fc9c1614b510","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T17:53:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"d6a8a4ee-c346-47b2-8011-fc9c1614b510","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"info","ts":"2026-07-10T17:53:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d6a8a4ee-c346-47b2-8011-fc9c1614b510","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T17:53:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"d6a8a4ee-c346-47b2-8011-fc9c1614b510","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T17:53:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"525e05f1-74d9-43ff-9d34-b724127bbb84","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.18:52060","PortSpecifier":{"PortValue":52060}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.64:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"525e05f1-74d9-43ff-9d34-b724127bbb84","method":"POST","path":"/maas-api/v1/api-keys","host":"e2e-shared-b-9f66f0.apps.c2229a72-d6cf-469e-9ffe-bddae96f0fc5.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T17:53:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"525e05f1-74d9-43ff-9d34-b724127bbb84","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.18:52060","PortSpecifier":{"PortValue":52060}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.64:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783706018,"nanos":626302822},"http":{"id":"525e05f1-74d9-43ff-9d34-b724127bbb84","method":"POST","headers":{":authority":"e2e-shared-b-9f66f0.apps.c2229a72-d6cf-469e-9ffe-bddae96f0fc5.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T17:53:38Z","logger":"authorino.service.auth.authpipeline.identity.kubernetesauth","msg":"calling kubernetes token review api","request id":"525e05f1-74d9-43ff-9d34-b724127bbb84","tokenreview":{"name":""}}
{"level":"debug","ts":"2026-07-10T17:53:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"525e05f1-74d9-43ff-9d34-b724127bbb84","config":{"Name":"openshift-identities","Priority":2,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":null,"OAuth2":null,"JWTAuthentication":null,"MTLS":null,"HMAC":null,"APIKey":null,"KubernetesAuth":{"AuthCredentials":{"KeySelector":"Bearer","In":"authorization_header"}},"Plain":null,"Noop":null,"ExtendedProperties":[]},"object":{"authenticated":true,"user":{"username":"system:serviceaccount:default:tester-regular-user","uid":"3e01e4b4-81fa-44f6-acfe-5e63bab66066","groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"extra":{"authentication.kubernetes.io/credential-id":["JTI=7eaac46e-c3e2-4f3a-8cb3-07e472cf6884"]}},"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/bddae96f0fc5"]}}
{"level":"debug","ts":"2026-07-10T17:53:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"525e05f1-74d9-43ff-9d34-b724127bbb84","input":{"auth":{"identity":{"audiences":["https://prod-eaas-bucket.s3.us-east-1.amazonaws.com/bddae96f0fc5"],"authenticated":true,"user":{"extra":{"authentication.kubernetes.io/credential-id":["JTI=7eaac46e-c3e2-4f3a-8cb3-07e472cf6884"]},"groups":["system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"uid":"3e01e4b4-81fa-44f6-acfe-5e63bab66066","username":"system:serviceaccount:default:tester-regular-user"}}},"context":{"context_extensions":{"host":"32f8bb12835c4547c09efd571f14bed6f00808f58c9721b3dcb758a8fa6c6de5"},"destination":{"address":{"Address":{"SocketAddress":{"PortSpecifier":{"PortValue":443},"address":"10.133.0.64:443"}}}},"metadata_context":{},"request":{"http":{"headers":{":authority":"e2e-shared-b-9f66f0.apps.c2229a72-d6cf-469e-9ffe-bddae96f0fc5.prod.konfluxeaas.com",":method":"POST",":path":"/maas-api/v1/api-keys",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T17:53:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"525e05f1-74d9-43ff-9d34-b724127bbb84","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T17:53:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"525e05f1-74d9-43ff-9d34-b724127bbb84","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T17:53:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"525e05f1-74d9-43ff-9d34-b724127bbb84","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-9f66f0/rate-test-model-9f66f0\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T17:53:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"cannot build dynamic response","request id":"525e05f1-74d9-43ff-9d34-b724127bbb84","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"keyId","Value":{}}]},"Plain":null},"reason":"no such key: metadata"}
{"level":"debug","ts":"2026-07-10T17:53:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"525e05f1-74d9-43ff-9d34-b724127bbb84","config":{"Name":"X-MaaS-Group-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T17:53:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"525e05f1-74d9-43ff-9d34-b724127bbb84","config":{"Name":"X-MaaS-Username-Token","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"info","ts":"2026-07-10T17:53:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"525e05f1-74d9-43ff-9d34-b724127bbb84","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T17:53:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"525e05f1-74d9-43ff-9d34-b724127bbb84","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T17:53:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8ac4c702-9d35-4ff9-b657-0082de925b0b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.18:59176","PortSpecifier":{"PortValue":59176}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.58:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"8ac4c702-9d35-4ff9-b657-0082de925b0b","method":"POST","path":"/ai-tenant-e2e-shared-a-3beb3b/rate-test-model-3beb3b/v1/completions","host":"e2e-shared-a-3beb3b.apps.c2229a72-d6cf-469e-9ffe-bddae96f0fc5.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T17:53:38Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"8ac4c702-9d35-4ff9-b657-0082de925b0b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.18:59176","PortSpecifier":{"PortValue":59176}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.58:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783706018,"nanos":663098802},"http":{"id":"8ac4c702-9d35-4ff9-b657-0082de925b0b","method":"POST","headers":{":authority":"e2e-shared-a-3beb3b.apps.c2229a72-d6cf-469e-9ffe-bddae96f0fc5.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-3beb3b/rate-test-model-3beb3b/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T17:53:38Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"8ac4c702-9d35-4ff9-b657-0082de925b0b","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1FSQGECSCZef7jWLi_RoUFva7OcGW2Udt75zdyMQV1BWBRRz0muHjVRWwggho"}
{"level":"debug","ts":"2026-07-10T17:53:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"8ac4c702-9d35-4ff9-b657-0082de925b0b","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-3beb3b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1FSQGECSCZef7jWLi_RoUFva7OcGW2Udt75zdyMQV1BWBRRz0muHjVRWwggho\"}"}
{"level":"debug","ts":"2026-07-10T17:53:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"8ac4c702-9d35-4ff9-b657-0082de925b0b","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-3beb3b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"866eaebd-ec24-4468-be1c-55437d4977d2","keyName":"e2e-rate-a-6ac59f","subscription":"e2e-rate-iso-a-6ac59f","tenant":"e2e-shared-a-3beb3b","userId":"866eaebd-ec24-4468-be1c-55437d4977d2","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T17:53:38Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"8ac4c702-9d35-4ff9-b657-0082de925b0b","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-3beb3b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-3beb3b/rate-test-model-3beb3b\",\"requestedSubscription\":\"e2e-rate-iso-a-6ac59f\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-10T17:53:38Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"8ac4c702-9d35-4ff9-b657-0082de925b0b","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-3beb3b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-3beb3b","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-6ac59f","namespace":"ai-tenant-e2e-shared-a-3beb3b","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-10T17:53:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"8ac4c702-9d35-4ff9-b657-0082de925b0b","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T17:53:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8ac4c702-9d35-4ff9-b657-0082de925b0b","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T17:53:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8ac4c702-9d35-4ff9-b657-0082de925b0b","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T17:53:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8ac4c702-9d35-4ff9-b657-0082de925b0b","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T17:53:38Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"8ac4c702-9d35-4ff9-b657-0082de925b0b","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-3beb3b/rate-test-model-3beb3b\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T17:53:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8ac4c702-9d35-4ff9-b657-0082de925b0b","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T17:53:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8ac4c702-9d35-4ff9-b657-0082de925b0b","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-6ac59f"}
{"level":"debug","ts":"2026-07-10T17:53:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8ac4c702-9d35-4ff9-b657-0082de925b0b","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T17:53:38Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"8ac4c702-9d35-4ff9-b657-0082de925b0b","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"866eaebd-ec24-4468-be1c-55437d4977d2","keyName":"e2e-rate-a-6ac59f","selected_subscription":"e2e-rate-iso-a-6ac59f","selected_subscription_key":"ai-tenant-e2e-shared-a-3beb3b/e2e-rate-iso-a-6ac59f@ai-tenant-e2e-shared-a-3beb3b/rate-test-model-3beb3b","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-3beb3b","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-6ac59f","namespace":"ai-tenant-e2e-shared-a-3beb3b","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-10T17:53:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8ac4c702-9d35-4ff9-b657-0082de925b0b","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T17:53:38Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"8ac4c702-9d35-4ff9-b657-0082de925b0b","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T17:53:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0badbba2-6bd7-4450-812d-f43f7b872908","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.18:59192","PortSpecifier":{"PortValue":59192}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.58:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"0badbba2-6bd7-4450-812d-f43f7b872908","method":"POST","path":"/ai-tenant-e2e-shared-a-3beb3b/rate-test-model-3beb3b/v1/completions","host":"e2e-shared-a-3beb3b.apps.c2229a72-d6cf-469e-9ffe-bddae96f0fc5.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T17:53:39Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"0badbba2-6bd7-4450-812d-f43f7b872908","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.18:59192","PortSpecifier":{"PortValue":59192}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.58:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783706019,"nanos":697668677},"http":{"id":"0badbba2-6bd7-4450-812d-f43f7b872908","method":"POST","headers":{":authority":"e2e-shared-a-3beb3b.apps.c2229a72-d6cf-469e-9ffe-bddae96f0fc5.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-3beb3b/rate-test-model-3beb3b/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T17:53:39Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"0badbba2-6bd7-4450-812d-f43f7b872908","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1FSQGECSCZef7jWLi_RoUFva7OcGW2Udt75zdyMQV1BWBRRz0muHjVRWwggho"}
{"level":"debug","ts":"2026-07-10T17:53:39Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"0badbba2-6bd7-4450-812d-f43f7b872908","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-3beb3b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1FSQGECSCZef7jWLi_RoUFva7OcGW2Udt75zdyMQV1BWBRRz0muHjVRWwggho\"}"}
{"level":"debug","ts":"2026-07-10T17:53:39Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"0badbba2-6bd7-4450-812d-f43f7b872908","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-3beb3b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"866eaebd-ec24-4468-be1c-55437d4977d2","keyName":"e2e-rate-a-6ac59f","subscription":"e2e-rate-iso-a-6ac59f","tenant":"e2e-shared-a-3beb3b","userId":"866eaebd-ec24-4468-be1c-55437d4977d2","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T17:53:39Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"0badbba2-6bd7-4450-812d-f43f7b872908","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-3beb3b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-3beb3b/rate-test-model-3beb3b\",\"requestedSubscription\":\"e2e-rate-iso-a-6ac59f\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-10T17:53:39Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"0badbba2-6bd7-4450-812d-f43f7b872908","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-3beb3b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-3beb3b","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-6ac59f","namespace":"ai-tenant-e2e-shared-a-3beb3b","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-10T17:53:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"0badbba2-6bd7-4450-812d-f43f7b872908","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T17:53:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0badbba2-6bd7-4450-812d-f43f7b872908","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T17:53:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0badbba2-6bd7-4450-812d-f43f7b872908","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T17:53:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0badbba2-6bd7-4450-812d-f43f7b872908","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-3beb3b/rate-test-model-3beb3b\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T17:53:39Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"0badbba2-6bd7-4450-812d-f43f7b872908","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T17:53:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0badbba2-6bd7-4450-812d-f43f7b872908","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T17:53:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0badbba2-6bd7-4450-812d-f43f7b872908","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T17:53:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0badbba2-6bd7-4450-812d-f43f7b872908","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-6ac59f"}
{"level":"debug","ts":"2026-07-10T17:53:39Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"0badbba2-6bd7-4450-812d-f43f7b872908","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"866eaebd-ec24-4468-be1c-55437d4977d2","keyName":"e2e-rate-a-6ac59f","selected_subscription":"e2e-rate-iso-a-6ac59f","selected_subscription_key":"ai-tenant-e2e-shared-a-3beb3b/e2e-rate-iso-a-6ac59f@ai-tenant-e2e-shared-a-3beb3b/rate-test-model-3beb3b","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-3beb3b","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-6ac59f","namespace":"ai-tenant-e2e-shared-a-3beb3b","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-10T17:53:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0badbba2-6bd7-4450-812d-f43f7b872908","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T17:53:39Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"0badbba2-6bd7-4450-812d-f43f7b872908","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T17:53:40Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3ef97a3f-ad45-41cf-ac74-403cccafe2a0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.18:59200","PortSpecifier":{"PortValue":59200}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.58:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"3ef97a3f-ad45-41cf-ac74-403cccafe2a0","method":"POST","path":"/ai-tenant-e2e-shared-a-3beb3b/rate-test-model-3beb3b/v1/completions","host":"e2e-shared-a-3beb3b.apps.c2229a72-d6cf-469e-9ffe-bddae96f0fc5.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T17:53:40Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"3ef97a3f-ad45-41cf-ac74-403cccafe2a0","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.18:59200","PortSpecifier":{"PortValue":59200}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.58:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783706020,"nanos":733491594},"http":{"id":"3ef97a3f-ad45-41cf-ac74-403cccafe2a0","method":"POST","headers":{":authority":"e2e-shared-a-3beb3b.apps.c2229a72-d6cf-469e-9ffe-bddae96f0fc5.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-3beb3b/rate-test-model-3beb3b/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T17:53:40Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"3ef97a3f-ad45-41cf-ac74-403cccafe2a0","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1FSQGECSCZef7jWLi_RoUFva7OcGW2Udt75zdyMQV1BWBRRz0muHjVRWwggho"}
{"level":"debug","ts":"2026-07-10T17:53:40Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"3ef97a3f-ad45-41cf-ac74-403cccafe2a0","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-3beb3b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1FSQGECSCZef7jWLi_RoUFva7OcGW2Udt75zdyMQV1BWBRRz0muHjVRWwggho\"}"}
{"level":"debug","ts":"2026-07-10T17:53:40Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"3ef97a3f-ad45-41cf-ac74-403cccafe2a0","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-3beb3b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"866eaebd-ec24-4468-be1c-55437d4977d2","keyName":"e2e-rate-a-6ac59f","subscription":"e2e-rate-iso-a-6ac59f","tenant":"e2e-shared-a-3beb3b","userId":"866eaebd-ec24-4468-be1c-55437d4977d2","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T17:53:40Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"3ef97a3f-ad45-41cf-ac74-403cccafe2a0","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-3beb3b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-3beb3b/rate-test-model-3beb3b\",\"requestedSubscription\":\"e2e-rate-iso-a-6ac59f\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-10T17:53:40Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"3ef97a3f-ad45-41cf-ac74-403cccafe2a0","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-3beb3b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-3beb3b","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-6ac59f","namespace":"ai-tenant-e2e-shared-a-3beb3b","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-10T17:53:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"3ef97a3f-ad45-41cf-ac74-403cccafe2a0","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T17:53:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3ef97a3f-ad45-41cf-ac74-403cccafe2a0","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T17:53:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3ef97a3f-ad45-41cf-ac74-403cccafe2a0","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T17:53:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3ef97a3f-ad45-41cf-ac74-403cccafe2a0","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-3beb3b/rate-test-model-3beb3b\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T17:53:40Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"3ef97a3f-ad45-41cf-ac74-403cccafe2a0","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T17:53:40Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3ef97a3f-ad45-41cf-ac74-403cccafe2a0","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T17:53:40Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3ef97a3f-ad45-41cf-ac74-403cccafe2a0","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T17:53:40Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3ef97a3f-ad45-41cf-ac74-403cccafe2a0","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-6ac59f"}
{"level":"debug","ts":"2026-07-10T17:53:40Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"3ef97a3f-ad45-41cf-ac74-403cccafe2a0","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"866eaebd-ec24-4468-be1c-55437d4977d2","keyName":"e2e-rate-a-6ac59f","selected_subscription":"e2e-rate-iso-a-6ac59f","selected_subscription_key":"ai-tenant-e2e-shared-a-3beb3b/e2e-rate-iso-a-6ac59f@ai-tenant-e2e-shared-a-3beb3b/rate-test-model-3beb3b","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-3beb3b","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-6ac59f","namespace":"ai-tenant-e2e-shared-a-3beb3b","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-10T17:53:40Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3ef97a3f-ad45-41cf-ac74-403cccafe2a0","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T17:53:40Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"3ef97a3f-ad45-41cf-ac74-403cccafe2a0","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T17:53:41Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a1f1cc77-fc44-4cb1-bfdc-2781c79aae52","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.18:59202","PortSpecifier":{"PortValue":59202}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.58:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"a1f1cc77-fc44-4cb1-bfdc-2781c79aae52","method":"POST","path":"/ai-tenant-e2e-shared-a-3beb3b/rate-test-model-3beb3b/v1/completions","host":"e2e-shared-a-3beb3b.apps.c2229a72-d6cf-469e-9ffe-bddae96f0fc5.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T17:53:41Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"a1f1cc77-fc44-4cb1-bfdc-2781c79aae52","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.18:59202","PortSpecifier":{"PortValue":59202}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.58:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783706021,"nanos":768079757},"http":{"id":"a1f1cc77-fc44-4cb1-bfdc-2781c79aae52","method":"POST","headers":{":authority":"e2e-shared-a-3beb3b.apps.c2229a72-d6cf-469e-9ffe-bddae96f0fc5.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-3beb3b/rate-test-model-3beb3b/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T17:53:41Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"a1f1cc77-fc44-4cb1-bfdc-2781c79aae52","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1FSQGECSCZef7jWLi_RoUFva7OcGW2Udt75zdyMQV1BWBRRz0muHjVRWwggho"}
{"level":"debug","ts":"2026-07-10T17:53:41Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a1f1cc77-fc44-4cb1-bfdc-2781c79aae52","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-3beb3b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1FSQGECSCZef7jWLi_RoUFva7OcGW2Udt75zdyMQV1BWBRRz0muHjVRWwggho\"}"}
{"level":"debug","ts":"2026-07-10T17:53:41Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a1f1cc77-fc44-4cb1-bfdc-2781c79aae52","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-3beb3b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"866eaebd-ec24-4468-be1c-55437d4977d2","keyName":"e2e-rate-a-6ac59f","subscription":"e2e-rate-iso-a-6ac59f","tenant":"e2e-shared-a-3beb3b","userId":"866eaebd-ec24-4468-be1c-55437d4977d2","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T17:53:41Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"a1f1cc77-fc44-4cb1-bfdc-2781c79aae52","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-3beb3b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-3beb3b/rate-test-model-3beb3b\",\"requestedSubscription\":\"e2e-rate-iso-a-6ac59f\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-10T17:53:41Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"a1f1cc77-fc44-4cb1-bfdc-2781c79aae52","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-3beb3b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-3beb3b","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-6ac59f","namespace":"ai-tenant-e2e-shared-a-3beb3b","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-10T17:53:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"a1f1cc77-fc44-4cb1-bfdc-2781c79aae52","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T17:53:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a1f1cc77-fc44-4cb1-bfdc-2781c79aae52","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T17:53:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a1f1cc77-fc44-4cb1-bfdc-2781c79aae52","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T17:53:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a1f1cc77-fc44-4cb1-bfdc-2781c79aae52","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T17:53:41Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"a1f1cc77-fc44-4cb1-bfdc-2781c79aae52","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-3beb3b/rate-test-model-3beb3b\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T17:53:41Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a1f1cc77-fc44-4cb1-bfdc-2781c79aae52","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-6ac59f"}
{"level":"debug","ts":"2026-07-10T17:53:41Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a1f1cc77-fc44-4cb1-bfdc-2781c79aae52","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T17:53:41Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a1f1cc77-fc44-4cb1-bfdc-2781c79aae52","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T17:53:41Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"a1f1cc77-fc44-4cb1-bfdc-2781c79aae52","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"866eaebd-ec24-4468-be1c-55437d4977d2","keyName":"e2e-rate-a-6ac59f","selected_subscription":"e2e-rate-iso-a-6ac59f","selected_subscription_key":"ai-tenant-e2e-shared-a-3beb3b/e2e-rate-iso-a-6ac59f@ai-tenant-e2e-shared-a-3beb3b/rate-test-model-3beb3b","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-3beb3b","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-6ac59f","namespace":"ai-tenant-e2e-shared-a-3beb3b","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-10T17:53:41Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a1f1cc77-fc44-4cb1-bfdc-2781c79aae52","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T17:53:41Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"a1f1cc77-fc44-4cb1-bfdc-2781c79aae52","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T17:53:42Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5fdc20e5-c727-4f36-bde3-9bab1f154022","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.18:59204","PortSpecifier":{"PortValue":59204}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.58:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"5fdc20e5-c727-4f36-bde3-9bab1f154022","method":"POST","path":"/ai-tenant-e2e-shared-a-3beb3b/rate-test-model-3beb3b/v1/completions","host":"e2e-shared-a-3beb3b.apps.c2229a72-d6cf-469e-9ffe-bddae96f0fc5.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T17:53:42Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"5fdc20e5-c727-4f36-bde3-9bab1f154022","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.18:59204","PortSpecifier":{"PortValue":59204}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.58:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783706022,"nanos":807814410},"http":{"id":"5fdc20e5-c727-4f36-bde3-9bab1f154022","method":"POST","headers":{":authority":"e2e-shared-a-3beb3b.apps.c2229a72-d6cf-469e-9ffe-bddae96f0fc5.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-3beb3b/rate-test-model-3beb3b/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T17:53:42Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"5fdc20e5-c727-4f36-bde3-9bab1f154022","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1FSQGECSCZef7jWLi_RoUFva7OcGW2Udt75zdyMQV1BWBRRz0muHjVRWwggho"}
{"level":"debug","ts":"2026-07-10T17:53:42Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"5fdc20e5-c727-4f36-bde3-9bab1f154022","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-3beb3b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1FSQGECSCZef7jWLi_RoUFva7OcGW2Udt75zdyMQV1BWBRRz0muHjVRWwggho\"}"}
{"level":"debug","ts":"2026-07-10T17:53:42Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"5fdc20e5-c727-4f36-bde3-9bab1f154022","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-3beb3b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"866eaebd-ec24-4468-be1c-55437d4977d2","keyName":"e2e-rate-a-6ac59f","subscription":"e2e-rate-iso-a-6ac59f","tenant":"e2e-shared-a-3beb3b","userId":"866eaebd-ec24-4468-be1c-55437d4977d2","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T17:53:42Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"5fdc20e5-c727-4f36-bde3-9bab1f154022","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-3beb3b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-3beb3b/rate-test-model-3beb3b\",\"requestedSubscription\":\"e2e-rate-iso-a-6ac59f\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-10T17:53:42Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"5fdc20e5-c727-4f36-bde3-9bab1f154022","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-3beb3b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-3beb3b","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-6ac59f","namespace":"ai-tenant-e2e-shared-a-3beb3b","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-10T17:53:42Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"5fdc20e5-c727-4f36-bde3-9bab1f154022","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T17:53:42Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5fdc20e5-c727-4f36-bde3-9bab1f154022","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T17:53:42Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5fdc20e5-c727-4f36-bde3-9bab1f154022","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T17:53:42Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5fdc20e5-c727-4f36-bde3-9bab1f154022","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T17:53:42Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"5fdc20e5-c727-4f36-bde3-9bab1f154022","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-3beb3b/rate-test-model-3beb3b\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T17:53:42Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5fdc20e5-c727-4f36-bde3-9bab1f154022","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T17:53:42Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5fdc20e5-c727-4f36-bde3-9bab1f154022","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-6ac59f"}
{"level":"debug","ts":"2026-07-10T17:53:42Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5fdc20e5-c727-4f36-bde3-9bab1f154022","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T17:53:42Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"5fdc20e5-c727-4f36-bde3-9bab1f154022","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"866eaebd-ec24-4468-be1c-55437d4977d2","keyName":"e2e-rate-a-6ac59f","selected_subscription":"e2e-rate-iso-a-6ac59f","selected_subscription_key":"ai-tenant-e2e-shared-a-3beb3b/e2e-rate-iso-a-6ac59f@ai-tenant-e2e-shared-a-3beb3b/rate-test-model-3beb3b","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-3beb3b","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-6ac59f","namespace":"ai-tenant-e2e-shared-a-3beb3b","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-10T17:53:42Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5fdc20e5-c727-4f36-bde3-9bab1f154022","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T17:53:42Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"5fdc20e5-c727-4f36-bde3-9bab1f154022","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T17:53:43Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2501f70f-5f26-4b7b-9bfb-e8de785afeba","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.18:59216","PortSpecifier":{"PortValue":59216}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.58:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"2501f70f-5f26-4b7b-9bfb-e8de785afeba","method":"POST","path":"/ai-tenant-e2e-shared-a-3beb3b/rate-test-model-3beb3b/v1/completions","host":"e2e-shared-a-3beb3b.apps.c2229a72-d6cf-469e-9ffe-bddae96f0fc5.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T17:53:43Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"2501f70f-5f26-4b7b-9bfb-e8de785afeba","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.18:59216","PortSpecifier":{"PortValue":59216}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.58:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783706023,"nanos":842692185},"http":{"id":"2501f70f-5f26-4b7b-9bfb-e8de785afeba","method":"POST","headers":{":authority":"e2e-shared-a-3beb3b.apps.c2229a72-d6cf-469e-9ffe-bddae96f0fc5.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-3beb3b/rate-test-model-3beb3b/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T17:53:43Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"2501f70f-5f26-4b7b-9bfb-e8de785afeba","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1FSQGECSCZef7jWLi_RoUFva7OcGW2Udt75zdyMQV1BWBRRz0muHjVRWwggho"}
{"level":"debug","ts":"2026-07-10T17:53:43Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"2501f70f-5f26-4b7b-9bfb-e8de785afeba","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-3beb3b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1FSQGECSCZef7jWLi_RoUFva7OcGW2Udt75zdyMQV1BWBRRz0muHjVRWwggho\"}"}
{"level":"debug","ts":"2026-07-10T17:53:43Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"2501f70f-5f26-4b7b-9bfb-e8de785afeba","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-3beb3b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"866eaebd-ec24-4468-be1c-55437d4977d2","keyName":"e2e-rate-a-6ac59f","subscription":"e2e-rate-iso-a-6ac59f","tenant":"e2e-shared-a-3beb3b","userId":"866eaebd-ec24-4468-be1c-55437d4977d2","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T17:53:43Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"2501f70f-5f26-4b7b-9bfb-e8de785afeba","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-3beb3b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-3beb3b/rate-test-model-3beb3b\",\"requestedSubscription\":\"e2e-rate-iso-a-6ac59f\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-10T17:53:43Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"2501f70f-5f26-4b7b-9bfb-e8de785afeba","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-3beb3b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-3beb3b","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-6ac59f","namespace":"ai-tenant-e2e-shared-a-3beb3b","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-10T17:53:43Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"2501f70f-5f26-4b7b-9bfb-e8de785afeba","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T17:53:43Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2501f70f-5f26-4b7b-9bfb-e8de785afeba","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T17:53:43Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2501f70f-5f26-4b7b-9bfb-e8de785afeba","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T17:53:43Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2501f70f-5f26-4b7b-9bfb-e8de785afeba","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-3beb3b/rate-test-model-3beb3b\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T17:53:43Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"2501f70f-5f26-4b7b-9bfb-e8de785afeba","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T17:53:43Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2501f70f-5f26-4b7b-9bfb-e8de785afeba","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T17:53:43Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2501f70f-5f26-4b7b-9bfb-e8de785afeba","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-6ac59f"}
{"level":"debug","ts":"2026-07-10T17:53:43Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2501f70f-5f26-4b7b-9bfb-e8de785afeba","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T17:53:43Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"2501f70f-5f26-4b7b-9bfb-e8de785afeba","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"866eaebd-ec24-4468-be1c-55437d4977d2","keyName":"e2e-rate-a-6ac59f","selected_subscription":"e2e-rate-iso-a-6ac59f","selected_subscription_key":"ai-tenant-e2e-shared-a-3beb3b/e2e-rate-iso-a-6ac59f@ai-tenant-e2e-shared-a-3beb3b/rate-test-model-3beb3b","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-3beb3b","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-6ac59f","namespace":"ai-tenant-e2e-shared-a-3beb3b","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-10T17:53:43Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2501f70f-5f26-4b7b-9bfb-e8de785afeba","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T17:53:43Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"2501f70f-5f26-4b7b-9bfb-e8de785afeba","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T17:53:44Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"22dbfce2-eb17-4f3e-ae7b-c35a06beb64c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.18:42956","PortSpecifier":{"PortValue":42956}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.58:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"22dbfce2-eb17-4f3e-ae7b-c35a06beb64c","method":"POST","path":"/ai-tenant-e2e-shared-a-3beb3b/rate-test-model-3beb3b/v1/completions","host":"e2e-shared-a-3beb3b.apps.c2229a72-d6cf-469e-9ffe-bddae96f0fc5.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T17:53:44Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"22dbfce2-eb17-4f3e-ae7b-c35a06beb64c","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.18:42956","PortSpecifier":{"PortValue":42956}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.58:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783706024,"nanos":878503465},"http":{"id":"22dbfce2-eb17-4f3e-ae7b-c35a06beb64c","method":"POST","headers":{":authority":"e2e-shared-a-3beb3b.apps.c2229a72-d6cf-469e-9ffe-bddae96f0fc5.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-3beb3b/rate-test-model-3beb3b/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T17:53:44Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"22dbfce2-eb17-4f3e-ae7b-c35a06beb64c","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1FSQGECSCZef7jWLi_RoUFva7OcGW2Udt75zdyMQV1BWBRRz0muHjVRWwggho"}
{"level":"debug","ts":"2026-07-10T17:53:44Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"22dbfce2-eb17-4f3e-ae7b-c35a06beb64c","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-3beb3b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1FSQGECSCZef7jWLi_RoUFva7OcGW2Udt75zdyMQV1BWBRRz0muHjVRWwggho\"}"}
{"level":"debug","ts":"2026-07-10T17:53:44Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"22dbfce2-eb17-4f3e-ae7b-c35a06beb64c","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-3beb3b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"866eaebd-ec24-4468-be1c-55437d4977d2","keyName":"e2e-rate-a-6ac59f","subscription":"e2e-rate-iso-a-6ac59f","tenant":"e2e-shared-a-3beb3b","userId":"866eaebd-ec24-4468-be1c-55437d4977d2","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T17:53:44Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"22dbfce2-eb17-4f3e-ae7b-c35a06beb64c","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-3beb3b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-3beb3b/rate-test-model-3beb3b\",\"requestedSubscription\":\"e2e-rate-iso-a-6ac59f\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-10T17:53:44Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"22dbfce2-eb17-4f3e-ae7b-c35a06beb64c","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-3beb3b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-3beb3b","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-6ac59f","namespace":"ai-tenant-e2e-shared-a-3beb3b","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-10T17:53:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"22dbfce2-eb17-4f3e-ae7b-c35a06beb64c","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T17:53:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"22dbfce2-eb17-4f3e-ae7b-c35a06beb64c","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T17:53:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"22dbfce2-eb17-4f3e-ae7b-c35a06beb64c","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T17:53:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"22dbfce2-eb17-4f3e-ae7b-c35a06beb64c","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-3beb3b/rate-test-model-3beb3b\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T17:53:44Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"22dbfce2-eb17-4f3e-ae7b-c35a06beb64c","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T17:53:44Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"22dbfce2-eb17-4f3e-ae7b-c35a06beb64c","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T17:53:44Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"22dbfce2-eb17-4f3e-ae7b-c35a06beb64c","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T17:53:44Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"22dbfce2-eb17-4f3e-ae7b-c35a06beb64c","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-6ac59f"}
{"level":"debug","ts":"2026-07-10T17:53:44Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"22dbfce2-eb17-4f3e-ae7b-c35a06beb64c","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"866eaebd-ec24-4468-be1c-55437d4977d2","keyName":"e2e-rate-a-6ac59f","selected_subscription":"e2e-rate-iso-a-6ac59f","selected_subscription_key":"ai-tenant-e2e-shared-a-3beb3b/e2e-rate-iso-a-6ac59f@ai-tenant-e2e-shared-a-3beb3b/rate-test-model-3beb3b","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-3beb3b","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-6ac59f","namespace":"ai-tenant-e2e-shared-a-3beb3b","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-10T17:53:44Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"22dbfce2-eb17-4f3e-ae7b-c35a06beb64c","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T17:53:44Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"22dbfce2-eb17-4f3e-ae7b-c35a06beb64c","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T17:53:45Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"09dc02bd-7817-4457-90ea-0982f7706f04","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.18:42970","PortSpecifier":{"PortValue":42970}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.58:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"09dc02bd-7817-4457-90ea-0982f7706f04","method":"POST","path":"/ai-tenant-e2e-shared-a-3beb3b/rate-test-model-3beb3b/v1/completions","host":"e2e-shared-a-3beb3b.apps.c2229a72-d6cf-469e-9ffe-bddae96f0fc5.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T17:53:45Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"09dc02bd-7817-4457-90ea-0982f7706f04","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.18:42970","PortSpecifier":{"PortValue":42970}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.58:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783706025,"nanos":910366200},"http":{"id":"09dc02bd-7817-4457-90ea-0982f7706f04","method":"POST","headers":{":authority":"e2e-shared-a-3beb3b.apps.c2229a72-d6cf-469e-9ffe-bddae96f0fc5.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-3beb3b/rate-test-model-3beb3b/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T17:53:45Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"09dc02bd-7817-4457-90ea-0982f7706f04","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1FSQGECSCZef7jWLi_RoUFva7OcGW2Udt75zdyMQV1BWBRRz0muHjVRWwggho"}
{"level":"debug","ts":"2026-07-10T17:53:45Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"09dc02bd-7817-4457-90ea-0982f7706f04","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-3beb3b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1FSQGECSCZef7jWLi_RoUFva7OcGW2Udt75zdyMQV1BWBRRz0muHjVRWwggho\"}"}
{"level":"debug","ts":"2026-07-10T17:53:45Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"09dc02bd-7817-4457-90ea-0982f7706f04","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-3beb3b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"866eaebd-ec24-4468-be1c-55437d4977d2","keyName":"e2e-rate-a-6ac59f","subscription":"e2e-rate-iso-a-6ac59f","tenant":"e2e-shared-a-3beb3b","userId":"866eaebd-ec24-4468-be1c-55437d4977d2","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T17:53:45Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"09dc02bd-7817-4457-90ea-0982f7706f04","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-3beb3b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-3beb3b/rate-test-model-3beb3b\",\"requestedSubscription\":\"e2e-rate-iso-a-6ac59f\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-10T17:53:45Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"09dc02bd-7817-4457-90ea-0982f7706f04","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-3beb3b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-3beb3b","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-6ac59f","namespace":"ai-tenant-e2e-shared-a-3beb3b","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-10T17:53:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"09dc02bd-7817-4457-90ea-0982f7706f04","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T17:53:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"09dc02bd-7817-4457-90ea-0982f7706f04","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T17:53:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"09dc02bd-7817-4457-90ea-0982f7706f04","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T17:53:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"09dc02bd-7817-4457-90ea-0982f7706f04","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T17:53:45Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"09dc02bd-7817-4457-90ea-0982f7706f04","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-3beb3b/rate-test-model-3beb3b\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T17:53:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"09dc02bd-7817-4457-90ea-0982f7706f04","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T17:53:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"09dc02bd-7817-4457-90ea-0982f7706f04","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T17:53:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"09dc02bd-7817-4457-90ea-0982f7706f04","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-6ac59f"}
{"level":"debug","ts":"2026-07-10T17:53:45Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"09dc02bd-7817-4457-90ea-0982f7706f04","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"866eaebd-ec24-4468-be1c-55437d4977d2","keyName":"e2e-rate-a-6ac59f","selected_subscription":"e2e-rate-iso-a-6ac59f","selected_subscription_key":"ai-tenant-e2e-shared-a-3beb3b/e2e-rate-iso-a-6ac59f@ai-tenant-e2e-shared-a-3beb3b/rate-test-model-3beb3b","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-3beb3b","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-6ac59f","namespace":"ai-tenant-e2e-shared-a-3beb3b","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-10T17:53:45Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"09dc02bd-7817-4457-90ea-0982f7706f04","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T17:53:45Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"09dc02bd-7817-4457-90ea-0982f7706f04","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T17:53:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"37b362c3-ac54-419c-bdd7-ca57a73fc676","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.18:42972","PortSpecifier":{"PortValue":42972}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.58:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"37b362c3-ac54-419c-bdd7-ca57a73fc676","method":"POST","path":"/ai-tenant-e2e-shared-a-3beb3b/rate-test-model-3beb3b/v1/completions","host":"e2e-shared-a-3beb3b.apps.c2229a72-d6cf-469e-9ffe-bddae96f0fc5.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T17:53:46Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"37b362c3-ac54-419c-bdd7-ca57a73fc676","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.18:42972","PortSpecifier":{"PortValue":42972}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.58:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783706026,"nanos":954287741},"http":{"id":"37b362c3-ac54-419c-bdd7-ca57a73fc676","method":"POST","headers":{":authority":"e2e-shared-a-3beb3b.apps.c2229a72-d6cf-469e-9ffe-bddae96f0fc5.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-3beb3b/rate-test-model-3beb3b/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T17:53:46Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"37b362c3-ac54-419c-bdd7-ca57a73fc676","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1FSQGECSCZef7jWLi_RoUFva7OcGW2Udt75zdyMQV1BWBRRz0muHjVRWwggho"}
{"level":"debug","ts":"2026-07-10T17:53:46Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"37b362c3-ac54-419c-bdd7-ca57a73fc676","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-3beb3b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1FSQGECSCZef7jWLi_RoUFva7OcGW2Udt75zdyMQV1BWBRRz0muHjVRWwggho\"}"}
{"level":"debug","ts":"2026-07-10T17:53:46Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"37b362c3-ac54-419c-bdd7-ca57a73fc676","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-3beb3b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"866eaebd-ec24-4468-be1c-55437d4977d2","keyName":"e2e-rate-a-6ac59f","subscription":"e2e-rate-iso-a-6ac59f","tenant":"e2e-shared-a-3beb3b","userId":"866eaebd-ec24-4468-be1c-55437d4977d2","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T17:53:46Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"37b362c3-ac54-419c-bdd7-ca57a73fc676","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-3beb3b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-3beb3b/rate-test-model-3beb3b\",\"requestedSubscription\":\"e2e-rate-iso-a-6ac59f\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-10T17:53:46Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"37b362c3-ac54-419c-bdd7-ca57a73fc676","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-3beb3b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-3beb3b","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-6ac59f","namespace":"ai-tenant-e2e-shared-a-3beb3b","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-10T17:53:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"37b362c3-ac54-419c-bdd7-ca57a73fc676","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T17:53:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"37b362c3-ac54-419c-bdd7-ca57a73fc676","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T17:53:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"37b362c3-ac54-419c-bdd7-ca57a73fc676","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T17:53:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"37b362c3-ac54-419c-bdd7-ca57a73fc676","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-3beb3b/rate-test-model-3beb3b\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T17:53:46Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"37b362c3-ac54-419c-bdd7-ca57a73fc676","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T17:53:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"37b362c3-ac54-419c-bdd7-ca57a73fc676","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T17:53:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"37b362c3-ac54-419c-bdd7-ca57a73fc676","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-6ac59f"}
{"level":"debug","ts":"2026-07-10T17:53:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"37b362c3-ac54-419c-bdd7-ca57a73fc676","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T17:53:46Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"37b362c3-ac54-419c-bdd7-ca57a73fc676","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"866eaebd-ec24-4468-be1c-55437d4977d2","keyName":"e2e-rate-a-6ac59f","selected_subscription":"e2e-rate-iso-a-6ac59f","selected_subscription_key":"ai-tenant-e2e-shared-a-3beb3b/e2e-rate-iso-a-6ac59f@ai-tenant-e2e-shared-a-3beb3b/rate-test-model-3beb3b","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-3beb3b","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-6ac59f","namespace":"ai-tenant-e2e-shared-a-3beb3b","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-10T17:53:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"37b362c3-ac54-419c-bdd7-ca57a73fc676","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T17:53:46Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"37b362c3-ac54-419c-bdd7-ca57a73fc676","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T17:53:47Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"321020ea-4041-4581-924e-0e16df653a6d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.18:42976","PortSpecifier":{"PortValue":42976}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.58:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"321020ea-4041-4581-924e-0e16df653a6d","method":"POST","path":"/ai-tenant-e2e-shared-a-3beb3b/rate-test-model-3beb3b/v1/completions","host":"e2e-shared-a-3beb3b.apps.c2229a72-d6cf-469e-9ffe-bddae96f0fc5.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T17:53:47Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"321020ea-4041-4581-924e-0e16df653a6d","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.18:42976","PortSpecifier":{"PortValue":42976}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.58:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783706027,"nanos":991615703},"http":{"id":"321020ea-4041-4581-924e-0e16df653a6d","method":"POST","headers":{":authority":"e2e-shared-a-3beb3b.apps.c2229a72-d6cf-469e-9ffe-bddae96f0fc5.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-a-3beb3b/rate-test-model-3beb3b/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T17:53:47Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"321020ea-4041-4581-924e-0e16df653a6d","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-1FSQGECSCZef7jWLi_RoUFva7OcGW2Udt75zdyMQV1BWBRRz0muHjVRWwggho"}
{"level":"debug","ts":"2026-07-10T17:53:47Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"321020ea-4041-4581-924e-0e16df653a6d","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-a-3beb3b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-1FSQGECSCZef7jWLi_RoUFva7OcGW2Udt75zdyMQV1BWBRRz0muHjVRWwggho\"}"}
{"level":"debug","ts":"2026-07-10T17:53:47Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"321020ea-4041-4581-924e-0e16df653a6d","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-3beb3b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"866eaebd-ec24-4468-be1c-55437d4977d2","keyName":"e2e-rate-a-6ac59f","subscription":"e2e-rate-iso-a-6ac59f","tenant":"e2e-shared-a-3beb3b","userId":"866eaebd-ec24-4468-be1c-55437d4977d2","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T17:53:47Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"321020ea-4041-4581-924e-0e16df653a6d","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-a-3beb3b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-a-3beb3b/rate-test-model-3beb3b\",\"requestedSubscription\":\"e2e-rate-iso-a-6ac59f\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-10T17:53:47Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"321020ea-4041-4581-924e-0e16df653a6d","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-a-3beb3b.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-3beb3b","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-6ac59f","namespace":"ai-tenant-e2e-shared-a-3beb3b","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-10T17:53:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"321020ea-4041-4581-924e-0e16df653a6d","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T17:53:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"321020ea-4041-4581-924e-0e16df653a6d","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T17:53:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"321020ea-4041-4581-924e-0e16df653a6d","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T17:53:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"321020ea-4041-4581-924e-0e16df653a6d","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-a-3beb3b/rate-test-model-3beb3b\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T17:53:47Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"321020ea-4041-4581-924e-0e16df653a6d","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T17:53:47Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"321020ea-4041-4581-924e-0e16df653a6d","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-a-6ac59f"}
{"level":"debug","ts":"2026-07-10T17:53:47Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"321020ea-4041-4581-924e-0e16df653a6d","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T17:53:47Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"321020ea-4041-4581-924e-0e16df653a6d","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T17:53:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"321020ea-4041-4581-924e-0e16df653a6d","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyName","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"userid","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"keyId","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"866eaebd-ec24-4468-be1c-55437d4977d2","keyName":"e2e-rate-a-6ac59f","selected_subscription":"e2e-rate-iso-a-6ac59f","selected_subscription_key":"ai-tenant-e2e-shared-a-3beb3b/e2e-rate-iso-a-6ac59f@ai-tenant-e2e-shared-a-3beb3b/rate-test-model-3beb3b","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-3beb3b","source":"internal","token_rate_limits":[{"limit":3,"window":"1m"}]}],"name":"e2e-rate-iso-a-6ac59f","namespace":"ai-tenant-e2e-shared-a-3beb3b","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-10T17:53:48Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"321020ea-4041-4581-924e-0e16df653a6d","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T17:53:48Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"321020ea-4041-4581-924e-0e16df653a6d","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T17:53:48Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f47b95ae-89c1-45ca-a694-53fc353c751b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.18:53544","PortSpecifier":{"PortValue":53544}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.64:443","PortSpecifier":{"PortValue":443}}}}},"request":{"http":{"id":"f47b95ae-89c1-45ca-a694-53fc353c751b","method":"POST","path":"/ai-tenant-e2e-shared-b-9f66f0/rate-test-model-9f66f0/v1/completions","host":"e2e-shared-b-9f66f0.apps.c2229a72-d6cf-469e-9ffe-bddae96f0fc5.prod.konfluxeaas.com","scheme":"https"}}}}
{"level":"debug","ts":"2026-07-10T17:53:48Z","logger":"authorino.service.auth","msg":"incoming authorization request","request id":"f47b95ae-89c1-45ca-a694-53fc353c751b","object":{"source":{"address":{"Address":{"SocketAddress":{"address":"10.132.0.18:53544","PortSpecifier":{"PortValue":53544}}}}},"destination":{"address":{"Address":{"SocketAddress":{"address":"10.133.0.64:443","PortSpecifier":{"PortValue":443}}}}},"request":{"time":{"seconds":1783706028,"nanos":26179811},"http":{"id":"f47b95ae-89c1-45ca-a694-53fc353c751b","method":"POST","headers":{":authority":"e2e-shared-b-9f66f0.apps.c2229a72-d6cf-469e-9ffe-bddae96f0fc5.prod.konfluxeaas.com",":method":"POST",":path":"/ai-tenant-e2e-shared-b-9f66f0/rate-test-model-9f66f0/v1/completions",":scheme":"https","accept":"*/*","accept-encoding":"gzip, deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T17:53:48Z","logger":"authorino.service.auth.authpipeline.identity","msg":"identity validated","request id":"f47b95ae-89c1-45ca-a694-53fc353c751b","config":{"Name":"api-keys","Priority":0,"Conditions":{"Left":{"Selector":"request.headers.authorization","Operator":5,"Value":"^Bearer **** sk-oai-6st82lzewmNZ8oR1_X1uZgCeuxEsXsHvm1dRpQ5uq2EhnwLCvJrUrqHKTN5i"}
{"level":"debug","ts":"2026-07-10T17:53:48Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"f47b95ae-89c1-45ca-a694-53fc353c751b","config":"apiKeyValidation","method":"POST","url":"https://maas-api-e2e-shared-b-9f66f0.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","headers":{"Content-Type":["application/json"]},"body":"{\"key\":\"sk-oai-6st82lzewmNZ8oR1_X1uZgCeuxEsXsHvm1dRpQ5uq2EhnwLCvJrUrqHKTN5i\"}"}
{"level":"debug","ts":"2026-07-10T17:53:48Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"f47b95ae-89c1-45ca-a694-53fc353c751b","config":{"Name":"apiKeyValidation","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-9f66f0.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/api-keys/validate","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"keyId":"3383c349-a328-481a-aad0-06f2529a2fb8","keyName":"e2e-rate-b-6ac59f","subscription":"e2e-rate-iso-b-6ac59f","tenant":"e2e-shared-b-9f66f0","userId":"3383c349-a328-481a-aad0-06f2529a2fb8","username":"system:serviceaccount:default:tester-regular-user","valid":true}}
{"level":"debug","ts":"2026-07-10T17:53:48Z","logger":"authorino.service.auth.authpipeline.metadata.http","msg":"sending request","request id":"f47b95ae-89c1-45ca-a694-53fc353c751b","config":"subscription-info","method":"POST","url":"https://maas-api-e2e-shared-b-9f66f0.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","headers":{"Content-Type":["application/json"]},"body":"{\"groups\":[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"],\"requestedModel\":\"ai-tenant-e2e-shared-b-9f66f0/rate-test-model-9f66f0\",\"requestedSubscription\":\"e2e-rate-iso-b-6ac59f\",\"username\":\"system:serviceaccount:default:tester-regular-user\"}"}
{"level":"debug","ts":"2026-07-10T17:53:48Z","logger":"authorino.service.auth.authpipeline.metadata","msg":"fetched auth metadata","request id":"f47b95ae-89c1-45ca-a694-53fc353c751b","config":{"Name":"subscription-info","Priority":1,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"UserInfo":null,"UMA":null,"GenericHTTP":{"Endpoint":"https://maas-api-e2e-shared-b-9f66f0.odh-ai-gateway-infra.svc.cluster.local:8443/internal/v1/subscriptions/select","DynamicEndpoint":null,"Method":"POST","Body":{},"Parameters":[],"Headers":[],"ContentType":"application/json","SharedSecret":"","OAuth2":null,"OAuth2TokenForceFetch":false,"AuthCredentials":null}},"object":{"modelRefs":[{"name":"rate-test-model-9f66f0","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-6ac59f","namespace":"ai-tenant-e2e-shared-b-9f66f0","phase":"Active","ready":true}}
{"level":"debug","ts":"2026-07-10T17:53:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"evaluating for input","request id":"f47b95ae-89c1-45ca-a694-53fc353c751b","input":{"auth":{"identity":"Bearer **** deflate","authorization":"Bearer **** deflate","authorization":"Bearer ****
{"level":"debug","ts":"2026-07-10T17:53:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f47b95ae-89c1-45ca-a694-53fc353c751b","config":{"Name":"tenant-gateway-isolation","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":null,"OPA":{"Rego":"# Tenant hostname isolation stub.\n# Replace with a real maas-api call to validate that the API key's tenant\n# matches the gateway hostname (prevents Coke key on Pepsi gateway).\nallow { true }","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T17:53:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f47b95ae-89c1-45ca-a694-53fc353c751b","config":{"Name":"auth-valid","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n  object.get(input.auth.metadata, \"apiKeyValidation\", {})\n  input.auth.metadata.apiKeyValidation.valid == true\n}\nallow {\n  not input.auth.metadata.apiKeyValidation\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T17:53:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f47b95ae-89c1-45ca-a694-53fc353c751b","config":{"Name":"require-group-membership","Priority":0,"Conditions":{"Left":null,"Right":null},"Metrics":false,"Cache":{},"OPA":{"Rego":"\nmodel_access := {\"ai-tenant-e2e-shared-b-9f66f0/rate-test-model-9f66f0\":{\"users\":null,\"groups\":[\"system:authenticated\"]}}\n\nrequest_path := object.get(input.context.request.http, \"path\", \"\")\nrequest_headers := object.get(input.context.request.http, \"headers\", {})\n\npath_parts := [p | p := split(request_path, \"/\")[_]; p != \"\"]\n\npath_model_identity := sprintf(\"%s/%s\", [path_parts[0], path_parts[1]]) {\n\tcount(path_parts) >= 2\n\tpath_parts[0] != \"v1\"\n\tpath_parts[0] != \"maas-api\"\n}\n\nraw_header_model_identity := object.get(request_headers, \"x-gateway-model-name\", \"\")\n\nheader_model_identity := sprintf(\"%s/%s\", [split(raw_header_model_identity, \"/\")[1], split(raw_header_model_identity, \"/\")[3]]) {\n\tstartswith(raw_header_model_identity, \"publishers/\")\n} else := raw_header_model_identity\n\nmodel_identity := path_model_identity {\n\tpath_model_identity != \"\"\n} else := header_model_identity {\n\theader_model_identity != \"\"\n} else := \"\"\n\nusername := input.auth.metadata.apiKeyValidation.username\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.username != \"\" }\nelse := input.auth.identity.preferred_username\n\t{ object.get(input.auth, \"identity\", {}).preferred_username != \"\" }\nelse := input.auth.identity.sub\n\t{ object.get(input.auth, \"identity\", {}).sub != \"\" }\nelse := input.auth.identity.user.username\n\t{ object.get(input.auth, \"identity\", {}).user.username != \"\" }\nelse := \"\"\n\ngroups := input.auth.metadata.apiKeyValidation.groups\n\t{ object.get(input.auth, \"metadata\", {}).apiKeyValidation.groups != [] }\nelse := input.auth.identity.groups\n\t{ object.get(input.auth, \"identity\", {}).groups != [] }\nelse := input.auth.identity.user.groups\n\t{ object.get(input.auth, \"identity\", {}).user.groups != [] }\nelse := []\n\nmodel_rules := object.get(model_access, model_identity, null)\n\n# Management endpoints (e.g. /v1/models, /maas-api/v1/api-keys) carry no model context.\n# Allow them here; subscription and rate-limit checks are gated by model-route conditions.\nallow {\n\tmodel_identity == \"\"\n}\n\n# Inference path: deny by default when no MaaSAuthPolicy covers this model.\n# Allow only when the caller's username or a group is explicitly listed.\nallow {\n\tmodel_rules != null\n\tmodel_rules.users[_] == username\n}\n\nallow {\n\tmodel_rules != null\n\tg := groups[_]\n\tmodel_rules.groups[_] == g\n}\n","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T17:53:48Z","logger":"authorino.service.auth.authpipeline.authorization","msg":"access granted","request id":"f47b95ae-89c1-45ca-a694-53fc353c751b","config":{"Name":"subscription-valid","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Metrics":false,"Cache":{},"OPA":{"Rego":"allow {\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"name\", \"\") != \"\"\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"error\", \"\") == \"\"\n\tphase := object.get(input.auth.metadata[\"subscription-info\"], \"phase\", \"\")\n\tany([phase == \"Active\", phase == \"Degraded\"])\n\tobject.get(input.auth.metadata[\"subscription-info\"], \"deletionTimestamp\", \"\") == \"\"\n}","ExternalSource":null,"AllValues":false},"JSON":null,"KubernetesAuthz":null,"Authzed":null},"object":{"allow":true}}
{"level":"debug","ts":"2026-07-10T17:53:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f47b95ae-89c1-45ca-a694-53fc353c751b","config":{"Name":"X-MaaS-Username","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Username","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{"Static":null,"Pattern":"auth.metadata.apiKeyValidation.username"}}},"object":"system:serviceaccount:default:tester-regular-user"}
{"level":"debug","ts":"2026-07-10T17:53:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f47b95ae-89c1-45ca-a694-53fc353c751b","config":{"Name":"X-MaaS-Subscription","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Subscription","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"e2e-rate-iso-b-6ac59f"}
{"level":"debug","ts":"2026-07-10T17:53:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f47b95ae-89c1-45ca-a694-53fc353c751b","config":{"Name":"X-MaaS-Group","Priority":0,"Conditions":{"Left":{},"Right":{"Left":null,"Right":null}},"Wrapper":"httpHeader","WrapperKey":"X-MaaS-Group","Metrics":false,"Cache":null,"Wristband":null,"DynamicJSON":null,"Plain":{"Value":{}}},"object":"[\"system:authenticated\",\"system:serviceaccounts\",\"system:serviceaccounts:default\",\"system:authenticated\"]"}
{"level":"debug","ts":"2026-07-10T17:53:48Z","logger":"authorino.service.auth.authpipeline.response","msg":"dynamic response built","request id":"f47b95ae-89c1-45ca-a694-53fc353c751b","config":{"Name":"identity","Priority":0,"Conditions":{"Left":null,"Right":null},"Wrapper":"envoyDynamicMetadata","WrapperKey":"identity","Metrics":true,"Cache":null,"Wristband":null,"DynamicJSON":{"Properties":[{"Name":"keyId","Value":{}},{"Name":"keyName","Value":{}},{"Name":"subscription_info","Value":{}},{"Name":"userid","Value":{}},{"Name":"selected_subscription","Value":{}},{"Name":"selected_subscription_key","Value":{}},{"Name":"groups","Value":{}},{"Name":"groups_str","Value":{}},{"Name":"subscription_error","Value":{}},{"Name":"subscription_error_message","Value":{}}]},"Plain":null},"object":{"groups":["system:authenticated","system:serviceaccounts","system:serviceaccounts:default","system:authenticated"],"groups_str":"system:authenticated,system:serviceaccounts,system:serviceaccounts:default,system:authenticated","keyId":"3383c349-a328-481a-aad0-06f2529a2fb8","keyName":"e2e-rate-b-6ac59f","selected_subscription":"e2e-rate-iso-b-6ac59f","selected_subscription_key":"ai-tenant-e2e-shared-b-9f66f0/e2e-rate-iso-b-6ac59f@ai-tenant-e2e-shared-b-9f66f0/rate-test-model-9f66f0","subscription_error":"","subscription_error_message":"","subscription_info":{"modelRefs":[{"name":"rate-test-model-9f66f0","source":"internal","token_rate_limits":[{"limit":100,"window":"1m"}]}],"name":"e2e-rate-iso-b-6ac59f","namespace":"ai-tenant-e2e-shared-b-9f66f0","phase":"Active","ready":true},"userid":"system:serviceaccount:default:tester-regular-user"}}
{"level":"info","ts":"2026-07-10T17:53:48Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f47b95ae-89c1-45ca-a694-53fc353c751b","authorized":true,"response":"OK"}
{"level":"debug","ts":"2026-07-10T17:53:48Z","logger":"authorino.service.auth","msg":"outgoing authorization response","request id":"f47b95ae-89c1-45ca-a694-53fc353c751b","authorized":true,"response":"OK"}
{"level":"info","ts":"2026-07-10T17:53:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/5edeb67e7d0909164ff56c952351e057cfdfef4b061a04ca491f655af38c6fc4"}
{"level":"info","ts":"2026-07-10T17:53:54Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/88d5b0f8219c3483206029353819f9a541082a6720ced97055f2fc2c8da7b251"}
{"level":"info","ts":"2026-07-10T17:53:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/c113bb4c59a7cb1d16bedc1f3326168b08faf9592dad1f285beeb24ebd7f7521"}
{"level":"info","ts":"2026-07-10T17:53:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/032b5f778367eb8a741f28a4f0de918770745d9bc96ad50f03d5cdc66414d68e"}
{"level":"info","ts":"2026-07-10T17:53:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/a72d19fb1df7be5dbd254fd3096b7419b973a8ef93faba0996992afa292a7d81"}
{"level":"info","ts":"2026-07-10T17:53:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/d1ee3352ba8335d3da2b6a9bec659c561d4e18ce5a9de62e196fbe1d09f2ff85"}
{"level":"info","ts":"2026-07-10T17:53:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/22569a450059b7b16efd9e0bdfedf5edb095432e6276bcc2a73681e0c8a2c2bc"}
{"level":"info","ts":"2026-07-10T17:53:55Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/2a49dfabf9dd2b940273e48365e5786445f6a2ae42d60ab6b5a96f59a669d36a"}
{"level":"info","ts":"2026-07-10T17:54:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/e3e13e8c2ce38b386a6ebd84a9b13ac6116c2efd89c4ae1d32220cb836c273b3"}
{"level":"info","ts":"2026-07-10T17:54:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/a2cfe30bae599a13d0ad096e345c366977da54ed88fb54d09236260055fb59ab"}
{"level":"info","ts":"2026-07-10T17:54:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/4ad7bf3834477a5b4457de2c7edaf443b0d8a6295dc994df9977c29a5579ac57"}
{"level":"info","ts":"2026-07-10T17:54:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/fb71d1587e27ceb11f9102fbb315326986aa1be57c7dd3d04bc4e7f414fe907e"}
{"level":"info","ts":"2026-07-10T17:54:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/b3740e7770f63b03b610e0dd41cbb1c50227bdc414eeb9954e03ed2c328af67b"}
{"level":"info","ts":"2026-07-10T17:54:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/8a9fe50b37dea316e9925c164c4d3e667cbe4c31fd1d4fd04eafb79c4edbfa96"}
{"level":"info","ts":"2026-07-10T17:54:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/dc86d4eb3e6c27ce523044c464a4a97dc25617003b6e6159d41c6e6fd59a376f"}
{"level":"info","ts":"2026-07-10T17:54:01Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/1905c217ab456dd10b0bd365bd89ee8cab40b7a6b011c11e6f44a8bbea719840"}
{"level":"info","ts":"2026-07-10T17:54:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/48352ac43f93a0ef720e4dbc0544cea25c7523c3bcb5ee74ace8ad736a96a4fc"}
{"level":"info","ts":"2026-07-10T17:54:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/5fe5cfe714cee1f160623c0fcfc7d499cb3269534ec8423d716891443ee95caa"}
{"level":"info","ts":"2026-07-10T17:54:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/70bff0f96baae2143676d9c0fc28581532add8ec5b2d3900596699566d13afb8"}
{"level":"info","ts":"2026-07-10T17:54:23Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/666c4064c80564b3583c630ddfa3ef5454d5ff954237f54e34a346468143ba9c"}
{"level":"info","ts":"2026-07-10T17:54:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/e5c6eb70c7280da1101ed31a75d81a4c1fd9ef8a688f373be71a4b780da1a137"}
{"level":"info","ts":"2026-07-10T17:54:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/44986b74e95212f14a87fab3f97ef169d106d7c35ffa23704b9149693f3efbda"}
{"level":"info","ts":"2026-07-10T17:54:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/32f8bb12835c4547c09efd571f14bed6f00808f58c9721b3dcb758a8fa6c6de5"}
{"level":"info","ts":"2026-07-10T17:54:49Z","logger":"authorino.controller-runtime.manager.controller.authconfig","msg":"resource de-indexed","authconfig":"kuadrant-system/e49d1830106dd17774362b919fc87393cdd06130726a1a2b6b4a51ff564d4161"}